PT-2021-7520 · Fortinet · Forticlient

Published 2021-10-28 · Updated 2022-07-12 · CVE-2021-43066

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiClient versions 7.0.2 and below FortiClient versions 6.4.6 and below FortiClient versions 6.2.9 and below FortiClient versions 6.0.10 and below

Description The issue is related to incorrect external control of a file name or path in the FortiClient.msi installer, which can allow an attacker to escalate their privileges.

Recommendations For FortiClient versions 7.0.2 and below, consider updating to a version above 7.0.2 to resolve the issue. For FortiClient versions 6.4.6 and below, consider updating to a version above 6.4.6 to resolve the issue. For FortiClient versions 6.2.9 and below, consider updating to a version above 6.2.9 to resolve the issue. For FortiClient versions 6.0.10 and below, consider updating to a version above 6.0.10 to resolve the issue.

Fix

Untrusted Search Path

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-73

CWE-426

CWE-668

Related Identifiers

BDU:2022-07203

CVE-2021-43066

Affected Products

Forticlient

References · 7

• https://osv.dev/vulnerability/CVE-2021-43066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43066 · Security Note
• https://fortiguard.com/advisory/FG-IR-21-154 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07203 · Security Note
• https://vuldb.com/?id.199539 · Note
• https://fortiguard.com/psirt/FG-IR-21-154 · Note
• https://t.me/cibsecurity/42400 · Telegram Post