Code Integrity Weakness in FortiClient by Fortinet
CVE-2023-22635

6.9MEDIUM

Key Information:

Vendor

Fortinet
Status
Forticlientmac
Vendor
CVE Published:
11 April 2023

What is CVE-2023-22635?

A vulnerability in FortiClient allows local attackers to escalate privileges by modifying the installer during an upgrade. The flaw arises from inadequate integrity checking of the download process across various versions of FortiClient, enabling potential exploitation if an attacker can access the local environment. Users of affected versions should apply security patches promptly to mitigate risks.

Affected Version(s)

FortiClientMac 7.0.0 <= 7.0.7

FortiClientMac 6.4.0 <= 6.4.10

FortiClientMac 6.2.0 <= 6.2.9

References

https://fortiguard.com/psirt/FG-IR-22-481

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.