PT-2023-9671 · Fortinet · Forticlient

CVE-2022-42470 · Publicado 2023-04-11 · Atualizado 2024-04-11

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiClient versions 6.0.0 through 6.0.10 Fortinet FortiClient versions 6.2.0 through 6.2.9 Fortinet FortiClient versions 6.4.0 through 6.4.9 Fortinet FortiClient versions 7.0.0 through 7.0.7

Description The issue is related to a relative path traversal vulnerability in Fortinet FortiClient. This vulnerability can be exploited by sending a crafted request to a specific named pipe, allowing an attacker to execute unauthorized code or commands.

Recommendations For Fortinet FortiClient versions 6.0.0 through 6.0.10, update to a version outside of this range to resolve the issue. For Fortinet FortiClient versions 6.2.0 through 6.2.9, update to a version outside of this range to resolve the issue. For Fortinet FortiClient versions 6.4.0 through 6.4.9, update to a version outside of this range to resolve the issue. For Fortinet FortiClient versions 7.0.0 through 7.0.7, update to a version outside of this range to resolve the issue.

Correção

Relative Path Traversal

Path traversal

Enumeração de Fraquezas

CWE-23

CWE-22

Identificadores relacionados

BDU:2024-09634

CVE-2022-42470

Produtos afetados

Forticlient

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-42470 · Nota de Segurança
• https://t.me/cibsecurity/61885 · Publicação no Telegram
• https://fortiguard.com/psirt/FG-IR-22-320 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-42470 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-09634 · Nota de Segurança