CyberCVE

CVE-2024-31489

AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 thro

Severity
Medium 6.4
CVSS 3.1
Exploited
Not listed
EPSS
0.004
29.2th percentile
Discovered by
Not disclosed
Published
Sep 10, 2024
Assigned by fortinet

Description

AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiGate and the FortiClient during the ZTNA tunnel creation

Weakness: CWE-295

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported affected versions (7)
  • Fortinet · FortiClientMac
  • Fortinet · FortiClientEMS
  • Fortinet · FortiClientLinux
  • Fortinet · FortiClientWindows
  • fortinet · forticlientmac
  • fortinet · forticlientlinux
  • fortinet · forticlientwindows

Vendor remediation

Please upgrade to FortiClientMac version 7.2.5 or above Please upgrade to FortiClientMac version 7.0.12 or above Please upgrade to FortiClientEMS version 7.2.0 or above Please upgrade to FortiClientLinux version 7.2.1 or above Please upgrade to FortiClientLinux version 7.0.12 or above Please upgrade to FortiClientWindows version 7.2.3 or above Please upgrade to FortiClientWindows version 7.0.12 or above

References