dbcve.org
Incorrect Default PermissionsWeakness · CWE-276

CVE-2024-46463

HIGH · 7.8 CVSS v3.1 Published 2024-11-15
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
83/100
Remediation priority · High
No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ORIZON has to be modified to prevent this vulnerability.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

ORIZON for Windows (up to version 2024.3) contains a permission misconfiguration vulnerability where dedicated folders used by the application have default access controls that allow other local users to read or modify technical files. This could enable an attacker with standard user privileges to access privileged files and potentially execute tasks with elevated permissions.

MitigationModify ORIZON's configuration to restrict folder permissions, implementing proper Windows Access Control Lists (ACLs) to ensure only authorized users and the ORIZON service account have access to technical folders.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm ORIZON installation and version
    Locate ORIZON installation directory (typically in Program Files or Program Files x86). Check for version information in the application executable, installer log, or application metadata. Compare your installed version against '2024.3' (versions 2024.3 and earlier are affected).
    Affected if Installed version is 2024.3 or lower, or version cannot be determined but installation predates the fix.
  2. Identify ORIZON technical folders
    Locate folders used by ORIZON for storing technical files, configuration data, logs, or runtime artifacts. Common locations include the application root directory, subdirectories for config, data, logs, or temp files. Examine folder names indicating technical purpose.
    Affected if The application stores technical files in any accessible directory.
  3. Examine folder permissions for all users group
    Right-click each ORIZON technical folder, select Properties, go to the Security tab, and inspect the Group or User names listed. Check if 'Users', 'Authenticated Users', 'Everyone', or 'Domain Users' groups are granted Read, Write, or Modify permissions.
    Affected if Any standard user or group (other than Administrators, System, or the ORIZON service account) has Read, Write, or Modify access to technical folders.
  4. Verify non-privileged user access
    Using a standard (non-admin) Windows account or by checking Effective Access in the folder Security tab, confirm whether a standard user can navigate into and list contents of ORIZON technical folders.
    Affected if A standard user account can successfully access and enumerate contents of ORIZON folders.
  5. Check for sensitive file accessibility
    Within ORIZON technical folders, identify files that may contain credentials, configuration with sensitive data, or executable files. Attempt to open or copy these files using a standard user account.
    Affected if Standard users can read, modify, or replace technical files such as config files, scripts, or executables in ORIZON folders.

A user is affected if ORIZON version 2024.3 or lower is installed AND any standard Windows user account can read or modify files in ORIZON's technical folders.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Modify ORIZON's configuration to restrict folder permissions, implementing proper Windows Access Control Lists (ACLs) to ensure only authorized users and the ORIZON service account have access to technical folders.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,980
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,168.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-46463 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-46463 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data