Fortinet FortiClient for Windows
En bref
- Source
- NVD
- EPSS
- EPSS 1.58 % · centile 76 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- fortinet
- Statut NVD
- Modified
Description
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
Faiblesses (CWE)
- CWE-798 — Utilisation d'identifiants codés en dur
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-20792
- GCVE · GCVE-0-2018-9195
Avis du CERT-FR
- CERTFR-2019-AVI-581 — Vulnérabilité dans les produits Fortinet · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*≤ 6.0.6cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*≤ 6.2.1cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*≤ 6.0.6
Produits affectés
| Produit | Versions |
|---|---|
| Fortinet · FortiClient for Windows | affected FortiClient for Windows 6.0.6 and below |
| Fortinet · FortiOS | affected FortiOS 6.0.7 and below |
| Fortinet · FortiClient for Mac OS | affected FortiClient for Mac OS 6.2.1 and below |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |