PT-2019-17767 · Fortinet · Forticlient Online Installer

Publicado 2019-05-28 · Atualizado 2019-05-29 · CVE-2019-5589

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiClient Online Installer versions prior to 6.0.6

Description The issue allows an unauthenticated, remote attacker with control over the directory where FortiClientOnlineInstaller.exe is located to execute arbitrary code on the system. This is achieved by uploading malicious .dll files to that directory.

Recommendations For versions prior to 6.0.6, update to version 6.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the directory where FortiClientOnlineInstaller.exe resides to prevent malicious .dll files from being uploaded.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2019-5589

Produtos afetados

Forticlient Online Installer

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-5589 · Aviso do Fabricante
• https://fortiguard.com/advisory/FG-IR-19-060 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5589 · Nota de Segurança