CVE-2022-33877

6.8MEDIUM

Key Information:

Vendor
Fortinet
Status
Forticonverter
Forticlientwindows
Vendor
CVE Published:
13 June 2023

Summary

An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConverter is installed in an insecure folder.

Affected Version(s)

FortiClientWindows 7.0.0 <= 7.0.6

FortiClientWindows 6.4.0 <= 6.4.8

FortiConverter 7.0.0

References

https://fortiguard.com/psirt/FG-IR-22-229

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.