Sign-up

ID

VAR-202111-0302


CVE

CVE-2021-42754


TITLE

FortiClientMacOS  Code injection vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-014513

DESCRIPTION

An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file. FortiClientMacOS There is a code injection vulnerability in.Information may be tampered with. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances

Trust: 1.71

sources: NVD: CVE-2021-42754 // JVNDB: JVNDB-2021-014513 // VULHUB: VHN-397998

AFFECTED PRODUCTS

vendor:fortinetmodel:forticlientscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:lteversion:6.4.5

Trust: 1.0

vendor:fortinetmodel:forticlientscope:eqversion:7.0.0

Trust: 1.0

vendor:フォーティネットmodel:forticlientscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:7.0.0 and earlier

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:lteversion:6.4.5 and earlier

Trust: 0.8

sources: JVNDB: JVNDB-2021-014513 // NVD: CVE-2021-42754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-42754
value: MEDIUM

Trust: 1.0

psirt@fortinet.com: CVE-2021-42754
value: LOW

Trust: 1.0

NVD: CVE-2021-42754
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202111-341
value: MEDIUM

Trust: 0.6

VULHUB: VHN-397998
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-42754
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-397998
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-42754
baseSeverity: MEDIUM
baseScore: 5.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 1.3
impactScore: 3.6
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-42754
baseSeverity: LOW
baseScore: 3.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.5
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2021-42754
baseSeverity: MEDIUM
baseScore: 5.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-397998 // JVNDB: JVNDB-2021-014513 // CNNVD: CNNVD-202111-341 // NVD: CVE-2021-42754 // NVD: CVE-2021-42754

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.1

problemtype:Code injection (CWE-94) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-397998 // JVNDB: JVNDB-2021-014513 // NVD: CVE-2021-42754

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202111-341

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-202111-341

PATCH

title:FG-IR-21-079url:https://www.fortiguard.com/psirt/FG-IR-21-079

Trust: 0.8

title:Fortinet FortiClient Fixes for code injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=169640

Trust: 0.6

sources: JVNDB: JVNDB-2021-014513 // CNNVD: CNNVD-202111-341

EXTERNAL IDS

db:NVDid:CVE-2021-42754

Trust: 3.3

db:JVNDBid:JVNDB-2021-014513

Trust: 0.8

db:CNNVDid:CNNVD-202111-341

Trust: 0.7

db:VULHUBid:VHN-397998

Trust: 0.1

sources: VULHUB: VHN-397998 // JVNDB: JVNDB-2021-014513 // CNNVD: CNNVD-202111-341 // NVD: CVE-2021-42754

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-079

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-42754

Trust: 1.4

url:https://vigilance.fr/vulnerability/fortinet-forticlientmac-information-disclosure-via-dylib-file-camera-36799

Trust: 0.6

sources: VULHUB: VHN-397998 // JVNDB: JVNDB-2021-014513 // CNNVD: CNNVD-202111-341 // NVD: CVE-2021-42754

SOURCES

db:VULHUBid:VHN-397998
db:JVNDBid:JVNDB-2021-014513
db:CNNVDid:CNNVD-202111-341
db:NVDid:CVE-2021-42754

LAST UPDATE DATE

2024-08-14T14:44:14.248000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-397998date:2021-11-04T00:00:00
db:JVNDBid:JVNDB-2021-014513date:2022-10-20T02:28:00
db:CNNVDid:CNNVD-202111-341date:2021-11-12T00:00:00
db:NVDid:CVE-2021-42754date:2021-11-04T14:15:14.147

SOURCES RELEASE DATE

db:VULHUBid:VHN-397998date:2021-11-02T00:00:00
db:JVNDBid:JVNDB-2021-014513date:2022-10-20T00:00:00
db:CNNVDid:CNNVD-202111-341date:2021-11-02T00:00:00
db:NVDid:CVE-2021-42754date:2021-11-02T19:15:08.223