PT-2022-11805 · Fortinet · Forticlient

Published 2022-04-06 · Updated 2022-04-13 · CVE-2021-43205

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiClient for Linux versions 7.0.2 and below FortiClient for Linux versions 6.4.7 and below FortiClient for Linux versions 6.2.9 and below

Description The issue allows an unauthenticated attacker to access the confighandler webserver via external binaries, potentially exposing sensitive information to unauthorized actors. This is due to an exposure of sensitive information vulnerability.

Recommendations For FortiClient for Linux versions 7.0.2 and below, update to a version above 7.0.2 to resolve the issue. For FortiClient for Linux versions 6.4.7 and below, update to a version above 6.4.7 to resolve the issue. For FortiClient for Linux versions 6.2.9 and below, update to a version above 6.2.9 to resolve the issue. As a temporary workaround, consider restricting access to the confighandler webserver to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-43205

Affected Products

Forticlient

References · 6

• https://osv.dev/vulnerability/CVE-2021-43205 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-21-226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43205 · Security Note
• https://t.me/cvenotify/28872 · Telegram Post
• https://t.me/cvenotify/28522 · Telegram Post
• https://t.me/cvenotify/28512 · Telegram Post