Lucene search

FortinetCVE-2017-14184

HistoryDec 15, 2017 - 9:29 p.m.

CVE-2017-14184

2017-12-1521:29:00

CWE-200

fortinet

web.nvd.nist.gov

cve-2017-14184

information disclosure

fortinet

forticlient

vpn

authentication

credentials

vulnerability

windows

mac osx

sslvpn

linux

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

32.2%

JSON

An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other’s VPN authentication credentials due to improperly secured storage locations.

Affected configurations

Nvd

Node

fortinetforticlientRange<5.6.0windows

Node

fortinetforticlientRange<5.6.0macos

Node

fortinetforticlient_sslvpn_clientRange<4.4.2334linux

VendorProductVersionCPE
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
fortinetforticlient*cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*
fortinetforticlient_sslvpn_client*cpe:2.3:a:fortinet:forticlient_sslvpn_client:*:*:*:*:*:linux:*:*

Vendor	Product	Version	CPE
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::windows::*
fortinet	forticlient	*	cpe:2.3:a:fortinet:forticlient::::::macos::*
fortinet	forticlient_sslvpn_client	*	cpe:2.3:a:fortinet:forticlient_sslvpn_client::::::linux::*

CNA Affected

[
  {
    "product": "FortiClient for Windows",
    "vendor": "Fortinet, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "5.6.0 and below"
      }
    ]
  },
  {
    "product": "FortiClient for Mac OSX",
    "vendor": "Fortinet, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "5.6.0 and below"
      }
    ]
  },
  {
    "product": "FortiClient SSLVPN Client for Linux",
    "vendor": "Fortinet, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "4.4.2334 and below"
      }
    ]
  }
]

References

www.securityfocus.com/bid/102123

fortiguard.com/advisory/FG-IR-17-214

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

32.2%

JSON

Related for CVE-2017-14184