Title: Folder Lock Weak Password Encryption Local Information Disclosure Vulnerability
Severity: LOW
Description:
Folder Lock is an application used to password-protect files and folders.
The application is prone to an information-disclosure vulnerability because it stores credentials in an insecure manner. Specifically, access credentials are stored within the Windows registry key 'HKEY_CURRENT_USER\Software\Microsoft\Windows\QualityControl'. Credentials are encrypted with an easy-to-determine rotation encryption scheme (ROT25).
A local attacker can exploit this issue to obtain passwords used by the application, which may aid in further attacks.
Folder Lock 5.9.5 is vulnerable; other versions may also be affected.
Affected Products:
- NewSoftwares.net Folder Lock 5.9.5
References:
- NewSoftwares.net: Folder Lock Homepage