CyberCVE

CVE-2024-50570

A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.

Severity
Medium 4.9
CVSS 3.1
Exploited
Not listed
EPSS
0.001
3.9th percentile
Discovered by
Not disclosed
Published
Dec 18, 2024
Assigned by fortinet

Description

A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScript's garbage collector

Weakness: CWE-312

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported affected versions (3)
  • Fortinet · FortiClientMac
  • Fortinet · FortiClientLinux
  • Fortinet · FortiClientWindows

Vendor remediation

Please upgrade to FortiClientLinux version 7.4.3 or above Please upgrade to FortiClientLinux version 7.2.8 or above Please upgrade to FortiClientLinux version 7.0.14 or above Please upgrade to FortiClientWindows version 7.4.2 or above Please upgrade to FortiClientWindows version 7.2.7 or above Please upgrade to FortiClientWindows version 7.0.14 or above

References