CVE-2023-22635

Published Apr 11, 2023 CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiClientMac

unaffected

Version	Status	Constraints
`7.0.0`	affected	≤ 7.0.7
`6.4.0`	affected	≤ 6.4.10
`6.2.0`	affected	≤ 6.2.9
`6.0.1`	affected	≤ 6.0.10
`5.6.5`	affected	≤ 5.6.6
`5.6.3`	affected	—
`5.6.0`	affected	≤ 5.6.1
`5.4.0`	affected	≤ 5.4.4
`5.2.0`	affected	≤ 5.2.6
`5.0.0`	affected	≤ 5.0.10
`4.0.0`	affected	≤ 4.0.3

Configuration 1 [-]

OR	cpe:2.3:a:fortinet:forticlient::::::macos::*
	cpe:2.3:a:fortinet:forticlient::::::macos::*
	cpe:2.3:a:fortinet:forticlient::::::macos::*

No data.

No data available yet.

Remediation

Vendor Solution

Please upgrade to FortiClientMac version 7.0.8 or above. Please upgrade to FortiClientMac version 7.2.0 or above.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-26769	A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade.