CVE-2022-33877

2023-06-1309:15:14

CWE-276

[email protected]

web.nvd.nist.gov

forticlient

forticonverter

windows

vulnerability

cwe-276

nvd

cve-2022-33877

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F

5.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConverter is installed in an insecure folder.

Affected configurations

NVD

Node

fortinetforticlientRange6.4.0–6.4.8windows

fortinetforticlientRange7.0.0–7.0.6windows

fortinetforticonverterRange6.0.0–6.0.3windows

fortinetforticonverterMatch6.2.0windows

fortinetforticonverterMatch6.2.1windows

fortinetforticonverterMatch7.0.0windows

CPENameOperatorVersion
fortinet:forticlientfortinet forticlientle6.4.8
fortinet:forticlientfortinet forticlientle7.0.6
fortinet:forticonverterfortinet forticonverterle6.0.3
fortinet:forticonverterfortinet forticonvertereq6.2.0
fortinet:forticonverterfortinet forticonvertereq6.2.1
fortinet:forticonverterfortinet forticonvertereq7.0.0

CPE	Name	Operator	Version
fortinet:forticlient	fortinet forticlient	le	6.4.8
fortinet:forticlient	fortinet forticlient	le	7.0.6
fortinet:forticonverter	fortinet forticonverter	le	6.0.3
fortinet:forticonverter	fortinet forticonverter	eq	6.2.0
fortinet:forticonverter	fortinet forticonverter	eq	6.2.1
fortinet:forticonverter	fortinet forticonverter	eq	7.0.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiConverter",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientWindows",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.8",
        "status": "affected"
      }
    ]
  }
]