An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
History

Thu, 14 Nov 2024 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet forticlient
CPEs cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*
cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:macos:*:*
Vendors & Products Fortinet forticlient

Wed, 13 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet
Fortinet forticlientmac
CPEs cpe:2.3:a:fortinet:forticlientmac:*:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet forticlientmac
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 12 Nov 2024 19:00:00 +0000

Type Values Removed Values Added
Description An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
Weaknesses CWE-347
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}


cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2024-11-12T18:53:49.686Z

Updated: 2024-11-13T18:30:43.925Z

Reserved: 2024-07-05T11:55:50.011Z

Link: CVE-2024-40592

cve-icon Vulnrichment

Updated: 2024-11-13T18:30:35.763Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-12T19:15:11.013

Modified: 2024-11-14T20:37:06.040

Link: CVE-2024-40592

cve-icon Redhat

No data.