Sign-up

ID

VAR-202002-0485


CVE

CVE-2019-15711


TITLE

Linux for FortiClient Vulnerability related to authority management in

Trust: 0.8

sources: JVNDB: JVNDB-2019-014530

DESCRIPTION

A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted "ExportLogs" type IPC client requests to the fctsched process. Linux for FortiClient Exists in a privilege management vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. There is a command injection vulnerability in Fortinet FortiClient 6.2.1 and earlier versions based on the Linux platform. The vulnerability stems from the fact that the program does not properly handle user input

Trust: 1.71

sources: NVD: CVE-2019-15711 // JVNDB: JVNDB-2019-014530 // VULHUB: VHN-147785

AFFECTED PRODUCTS

vendor:fortinetmodel:forticlientscope:lteversion:6.2.1

Trust: 1.0

vendor:fortinetmodel:forticlientscope:eqversion:6.2.1

Trust: 0.8

sources: JVNDB: JVNDB-2019-014530 // NVD: CVE-2019-15711

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-15711
value: HIGH

Trust: 1.0

NVD: JVNDB-2019-014530
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201911-1059
value: HIGH

Trust: 0.6

VULHUB: VHN-147785
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-15711
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2019-014530
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-147785
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-15711
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2019-014530
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-147785 // JVNDB: JVNDB-2019-014530 // CNNVD: CNNVD-201911-1059 // NVD: CVE-2019-15711

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-269

Trust: 0.8

sources: JVNDB: JVNDB-2019-014530 // NVD: CVE-2019-15711

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-1059

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-201911-1059

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-014530

PATCH
title:FG-IR-19-238url:https://fortiguard.com/psirt/FG-IR-19-238
Trust: 0.8
title:Fortinet FortiClient Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=109176
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-014530 // 
            
            
            
            CNNVD: CNNVD-201911-1059

EXTERNAL IDS
db:NVDid:CVE-2019-15711
Trust: 2.5
db:JVNDBid:JVNDB-2019-014530
Trust: 0.8
db:CNNVDid:CNNVD-201911-1059
Trust: 0.7
db:AUSCERTid:ESB-2019.4350.2
Trust: 0.6
db:AUSCERTid:ESB-2019.4350
Trust: 0.6
db:VULHUBid:VHN-147785
Trust: 0.1
sources:
            
            
            VULHUB: VHN-147785 // 
            
            
            
            JVNDB: JVNDB-2019-014530 // 
            
            
            
            CNNVD: CNNVD-201911-1059 // 
            
            
            
            NVD: CVE-2019-15711

REFERENCES
url:https://fortiguard.com/psirt/fg-ir-19-238
Trust: 2.3
url:https://danishcyberdefence.dk/blog/forticlient_linux
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-15711
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15711
Trust: 0.8
url:https://vigilance.fr/vulnerability/forticlient-for-linux-four-vulnerabilities-via-ipc-socket-30897
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4350/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4350.2/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-147785 // 
            
            
            
            JVNDB: JVNDB-2019-014530 // 
            
            
            
            CNNVD: CNNVD-201911-1059 // 
            
            
            
            NVD: CVE-2019-15711

SOURCES
db:VULHUBid:VHN-147785
db:JVNDBid:JVNDB-2019-014530
db:CNNVDid:CNNVD-201911-1059
db:NVDid:CVE-2019-15711

LAST UPDATE DATE
2024-11-23T21:51:40.695000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-147785date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2019-014530date:2020-02-25T00:00:00
db:CNNVDid:CNNVD-201911-1059date:2020-08-25T00:00:00
db:NVDid:CVE-2019-15711date:2024-11-21T04:29:18.347

SOURCES RELEASE DATE
db:VULHUBid:VHN-147785date:2020-02-06T00:00:00
db:JVNDBid:JVNDB-2019-014530date:2020-02-25T00:00:00
db:CNNVDid:CNNVD-201911-1059date:2019-11-18T00:00:00
db:NVDid:CVE-2019-15711date:2020-02-06T16:15:12.213