CVE-2024-31492
An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or c
Severity
High 7.8
CVSS 3.1
Exploited
Not listed
EPSS
0.003
25.7th percentile
Discovered by
Third party
Vendor advisory field
Published
Apr 10, 2024
Assigned by fortinet
Description
An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.
Weakness: CWE-73
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiClientMac
- fortinet · forticlientmac
Credit
Fortinet is pleased to thank Tomas Kabrt for reporting this vulnerability under responsible disclosure.
Vendor remediation
Please upgrade to FortiClientMac version 7.2.4 or above Please upgrade to FortiClientMac version 7.0.11 or above