CyberCVE

CVE-2024-50570

A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.

Severity
Medium 4.9
CVSS 3.1
Exploited
Not listed
EPSS
0.001
3.8th percentile
Discovered by
Third party
Vendor advisory field
Published
Dec 18, 2024
Assigned by fortinet

Description

A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScript's garbage collector

Weakness: CWE-312

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported products (3)
  • Fortinet · FortiClientMac
  • Fortinet · FortiClientLinux
  • Fortinet · FortiClientWindows

Credit

Fortinet is pleased to thank Efstratios Chatzoglou, Vyron Kampourakis, Zisis Tsiatsikas, Georgios Karopoulos, and Georgios Kambourakis from the University of the Aegean and the Norwegian University of Science and Technology, and Hassan Al-Khafaji from NourNet for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiClientLinux version 7.4.3 or above Please upgrade to FortiClientLinux version 7.2.8 or above Please upgrade to FortiClientLinux version 7.0.14 or above Please upgrade to FortiClientWindows version 7.4.2 or above Please upgrade to FortiClientWindows version 7.2.7 or above Please upgrade to FortiClientWindows version 7.0.14 or above

References

Something wrong here?