Sign-up

ID

VAR-202205-0417


CVE

CVE-2021-43066


TITLE

Fortinet FortiClientWindows  Vulnerability in leaking resources to the wrong area in

Trust: 0.8

sources: JVNDB: JVNDB-2022-011177

DESCRIPTION

A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer. Fortinet FortiClientWindows Exists in a vulnerability related to the leakage of resources to the wrong area.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2021-43066 // JVNDB: JVNDB-2022-011177 // VULHUB: VHN-404116 // VULMON: CVE-2021-43066

AFFECTED PRODUCTS

vendor:fortinetmodel:forticlientscope:gteversion:6.0.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:ltversion:7.0.3

Trust: 1.0

vendor:fortinetmodel:forticlientscope:gteversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:forticlientscope:ltversion:6.4.7

Trust: 1.0

vendor:フォーティネットmodel:forticlientscope: - version: -

Trust: 0.8

vendor:フォーティネットmodel:forticlientscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-011177 // NVD: CVE-2021-43066

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-43066
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2021-43066
value: HIGH

Trust: 1.0

NVD: CVE-2021-43066
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202205-1937
value: HIGH

Trust: 0.6

VULHUB: VHN-404116
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-43066
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-43066
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-404116
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-43066
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2021-43066
baseSeverity: HIGH
baseScore: 8.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.0
impactScore: 5.8
version: 3.1

Trust: 1.0

NVD: CVE-2021-43066
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-404116 // VULMON: CVE-2021-43066 // JVNDB: JVNDB-2022-011177 // CNNVD: CNNVD-202205-1937 // NVD: CVE-2021-43066 // NVD: CVE-2021-43066

PROBLEMTYPE DATA

problemtype:CWE-668

Trust: 1.1

problemtype:Leakage of resources to the wrong area (CWE-668) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-404116 // JVNDB: JVNDB-2022-011177 // NVD: CVE-2021-43066

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202205-1937

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202205-1937

PATCH

title:FG-IR-21-154url:https://www.fortiguard.com/psirt/FG-IR-21-154

Trust: 0.8

title:Fortinet FortiClient Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=193532

Trust: 0.6

title:Fortinet Security Advisories: FortiClient - Privilege escalation in FortiClient installerurl:https://vulmon.com/vendoradvisory?qidtp=fortinet_security_advisories&qid=FG-IR-21-154

Trust: 0.1

sources: VULMON: CVE-2021-43066 // JVNDB: JVNDB-2022-011177 // CNNVD: CNNVD-202205-1937

EXTERNAL IDS

db:NVDid:CVE-2021-43066

Trust: 3.4

db:JVNDBid:JVNDB-2022-011177

Trust: 0.8

db:CS-HELPid:SB2022050320

Trust: 0.6

db:CNNVDid:CNNVD-202205-1937

Trust: 0.6

db:VULHUBid:VHN-404116

Trust: 0.1

db:VULMONid:CVE-2021-43066

Trust: 0.1

sources: VULHUB: VHN-404116 // VULMON: CVE-2021-43066 // JVNDB: JVNDB-2022-011177 // CNNVD: CNNVD-202205-1937 // NVD: CVE-2021-43066

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-21-154

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-43066

Trust: 0.8

url:https://vigilance.fr/vulnerability/forticlient-privilege-escalation-via-windows-msi-installer-38207

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2021-43066/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022050320

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/610.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://fortiguard.com/psirt/fg-ir-21-154

Trust: 0.1

sources: VULHUB: VHN-404116 // VULMON: CVE-2021-43066 // JVNDB: JVNDB-2022-011177 // CNNVD: CNNVD-202205-1937 // NVD: CVE-2021-43066

SOURCES

db:VULHUBid:VHN-404116
db:VULMONid:CVE-2021-43066
db:JVNDBid:JVNDB-2022-011177
db:CNNVDid:CNNVD-202205-1937
db:NVDid:CVE-2021-43066

LAST UPDATE DATE

2024-08-14T15:06:23.706000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-404116date:2022-07-12T00:00:00
db:VULMONid:CVE-2021-43066date:2022-05-19T00:00:00
db:JVNDBid:JVNDB-2022-011177date:2023-08-21T01:55:00
db:CNNVDid:CNNVD-202205-1937date:2022-07-14T00:00:00
db:NVDid:CVE-2021-43066date:2022-07-12T17:42:04.277

SOURCES RELEASE DATE

db:VULHUBid:VHN-404116date:2022-05-11T00:00:00
db:VULMONid:CVE-2021-43066date:2022-05-11T00:00:00
db:JVNDBid:JVNDB-2022-011177date:2023-08-21T00:00:00
db:CNNVDid:CNNVD-202205-1937date:2022-05-03T00:00:00
db:NVDid:CVE-2021-43066date:2022-05-11T16:15:08.770