PT-2020-9939 · Fortinet · Fortitray+2

Published 2020-03-12 · Updated 2021-04-29 · CVE-2019-17658

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiClientWindows versions 6.2.2 and prior

Description The issue is related to an unquoted service path vulnerability in the FortiTray component, allowing an attacker to gain elevated privileges via the FortiClientConsole executable service path.

Recommendations For FortiClientWindows versions 6.2.2 and prior, update to a version that contains a fix for this issue to prevent exploitation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2019-17658

Affected Products

Forticlient

Forticlientconsole

Fortitray

References · 4

• https://osv.dev/vulnerability/CVE-2019-17658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17658 · Security Note
• https://fortiguard.com/advisory/FG-IR-19-281 · Vendor Advisory
• https://t.me/cvenotify/1618 · Telegram Post