Lucene search

[email protected]CVE-2023-37939

HistoryOct 10, 2023 - 5:15 p.m.

CVE-2023-37939

2023-10-1017:15:12

CWE-200

[email protected]

web.nvd.nist.gov

cve-2023-37939

sensitive information exposure

forticlient

vulnerability

cwe-200

nvd

unauthorized access

windows

linux

mac

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning.

Affected configurations

NVD

Node

fortinetforticlientRange6.2.0–6.2.9linux

fortinetforticlientRange6.2.0–6.2.9macos

fortinetforticlientRange6.2.0–6.2.9windows

fortinetforticlientRange6.4.0–6.4.9linux

fortinetforticlientRange6.4.0–6.4.10macos

fortinetforticlientRange6.4.0–6.4.10windows

fortinetforticlientRange7.0.0–7.0.9linux

fortinetforticlientRange7.0.0–7.0.9macos

fortinetforticlientRange7.0.0–7.0.9windows

fortinetforticlientMatch7.2.0linux

fortinetforticlientMatch7.2.0macos

fortinetforticlientMatch7.2.0windows

fortinetforticlientMatch7.2.1macos

CPENameOperatorVersion
fortinet:forticlientfortinet forticlientle6.2.9
fortinet:forticlientfortinet forticlientle6.4.9
fortinet:forticlientfortinet forticlientle6.4.10
fortinet:forticlientfortinet forticlientle7.0.9
fortinet:forticlientfortinet forticlienteq7.2.0
fortinet:forticlientfortinet forticlienteq7.2.1

CPE	Name	Operator	Version
fortinet:forticlient	fortinet forticlient	le	6.2.9
fortinet:forticlient	fortinet forticlient	le	6.4.9
fortinet:forticlient	fortinet forticlient	le	6.4.10
fortinet:forticlient	fortinet forticlient	le	7.0.9
fortinet:forticlient	fortinet forticlient	eq	7.2.0
fortinet:forticlient	fortinet forticlient	eq	7.2.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiClientMac",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientWindows",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiClientLinux",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.6",
        "lessThanOrEqual": "7.0.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.7",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.6",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.4",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-235

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.8 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-37939

prion1 nessus2 cvelist1 nvd1