CVE-2024-36497

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be used to remove the existing restrictions and disable WINSelect entirely.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-364984.7Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other CVE-2024-364995.5Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect servic CVE-2024-36505.4The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver CVE-2024-365005.5Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentialit CVE-2024-365015.5Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.CVE-2024-365025.5Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-365035.5Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-365046.5An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 a CVE-2024-365055.5An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may CVE-2024-365065.3An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all CVE-2024-365077.8A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an CVE-2024-365086.0An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.