| Assigner | Nozomi |
| Reserved | 2023-11-02 |
| Published | 2024-05-15 |
| Updated | 2024-06-06 |
Description
On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.
| CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N | |
| CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H |
Problem types
CWE-732 Incorrect Permission Assignment for Critical Resource
Product status
Any version before 1.6.0
Credits
This issue was found by Diego Giubertoni, Gabriele Quagliarella of Nozomi Networks Security Research team during an internal penetration testing session.
References
https://security.nozominetworks.com/NN-2023:15-01
