PT-2023-6000 · Fortinet · Forticlient For Linux+2

Published 2023-10-10 · Updated 2023-10-14 · CVE-2023-37939

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiClient for Windows versions 6.2 through 7.2.0 FortiClient for Linux versions 6.2 through 7.2.0 FortiClient for Mac versions 6.2 through 7.2.1

Description The issue allows a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning, due to an exposure of sensitive information to an unauthorized actor. This may enable the attacker to gain access to sensitive information.

Recommendations For FortiClient for Windows versions 6.2 through 7.2.0, update to a version that includes a fix for this issue. For FortiClient for Linux versions 6.2 through 7.2.0, update to a version that includes a fix for this issue. For FortiClient for Mac versions 6.2 through 7.2.1, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to sensitive files and folders to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-06701

CVE-2023-37939

Affected Products

Forticlient For Linux

Forticlient For Mac Osx

Forticlientwindows

References · 5

• https://fortiguard.com/psirt/FG-IR-22-235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37939 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06701 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37939 · Security Note
• https://t.me/cibsecurity/71963 · Telegram Post