Improper Permission Assignment in FortiClient for Linux
CVE-2021-44167

6.8MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Forticlientlinux
Vendor
CVE Published:
11 May 2022

Summary

A vulnerability exists in FortiClient for Linux versions 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, and 7.0.2 and below due to incorrect permission assignments on critical resources. This flaw allows unauthenticated attackers to exploit symbolic links, potentially gaining unauthorized access to sensitive information contained in log files and directories, posing a significant security risk.

Affected Version(s)

Fortinet FortiClientLinux FortiClientLinux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below

References

https://fortiguard.com/psirt/FG-IR-21-232
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.