FortiClient (Windows) - Arbitrary file creation from unprivileged users due to process impersonation

2023-04-1100:00:00

FortiGuard Labs

www.fortiguard.com

forticlient

windows

vulnerability

arbitrary file creation

filesystem

authorization

cwe-863

process impersonation

low privileged attacker

0.0004 Low

EPSS

Percentile

9.0%

JSON

An incorrect authorization [CWE-863] vulnerability in FortiClient (Windows) may allow a local low privileged attacker to perform arbitrary file creation in the device filesystem.

CPENameOperatorVersion
forticlientwindowseq7.0.7
forticlientwindowseq7.0.6
forticlientwindowseq7.0.5
forticlientwindowseq7.0.4
forticlientwindowseq7.0.3
forticlientwindowseq7.0.2
forticlientwindowseq7.0.1
forticlientwindowseq7.0.0
forticlientwindowseq6.4.9
forticlientwindowseq6.4.8

Name	Operator	Version
forticlientwindows	eq	7.0.7
forticlientwindows	eq	7.0.6
forticlientwindows	eq	7.0.5
forticlientwindows	eq	7.0.4
forticlientwindows	eq	7.0.3
forticlientwindows	eq	7.0.2
forticlientwindows	eq	7.0.1
forticlientwindows	eq	7.0.0
forticlientwindows	eq	6.4.9
forticlientwindows	eq	6.4.8

Rows per page:

1-10 of 401

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for FG-IR-22-336