ID
VAR-202207-0161
CVE
CVE-2021-41031
TITLE
Windows for FortiClient Past traversal vulnerability in
Trust: 0.8
DESCRIPTION
A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service. Windows for FortiClient Exists in a past traversal vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiClient is a mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances. A path traversal vulnerability exists in Fortinet FortiClient due to an input validation error when processing directory traversal sequences in filenames
Trust: 1.71
AFFECTED PRODUCTS
| vendor: | fortinet | model: | forticlient | scope: | gte | version: | 7.0.0 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | lte | version: | 6.4.6 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | gte | version: | 6.4.0 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | lte | version: | 6.2.9 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | lte | version: | 7.0.2 | Trust: 1.0 |
| vendor: | fortinet | model: | forticlient | scope: | gte | version: | 6.2.0 | Trust: 1.0 |
| vendor: | フォーティネット | model: | forticlient | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | フォーティネット | model: | forticlient | scope: | lte | version: | 6.4.6 and earlier | Trust: 0.8 |
| vendor: | フォーティネット | model: | forticlient | scope: | lte | version: | 7.0.2 and earlier | Trust: 0.8 |
| vendor: | フォーティネット | model: | forticlient | scope: | lte | version: | 6.2.9 and earlier | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-22 | Trust: 1.1 |
| problemtype: | Path traversal (CWE-22) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
path traversal
Trust: 0.6
PATCH
| title: | FG-IR-21-190 | url: | https://www.fortiguard.com/psirt/FG-IR-21-190 | Trust: 0.8 |
| title: | Fortinet FortiClient Repair measures for path traversal vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200691 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-41031 | Trust: 3.3 |
| db: | JVNDB | id: | JVNDB-2022-015426 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202207-384 | Trust: 0.7 |
| db: | CS-HELP | id: | SB2022070530 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-402301 | Trust: 0.1 |
REFERENCES
| url: | https://fortiguard.com/advisory/fg-ir-21-190 | Trust: 1.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-41031 | Trust: 0.8 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2022070530 | Trust: 0.6 |
| url: | https://cxsecurity.com/cveshow/cve-2021-41031/ | Trust: 0.6 |
| url: | https://vigilance.fr/vulnerability/fortinet-forticlient-privilege-escalation-via-fortiesnac-38740 | Trust: 0.6 |
SOURCES
| db: | VULHUB | id: | VHN-402301 |
| db: | JVNDB | id: | JVNDB-2022-015426 |
| db: | CNNVD | id: | CNNVD-202207-384 |
| db: | NVD | id: | CVE-2021-41031 |
LAST UPDATE DATE
2024-08-14T15:37:31.257000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-402301 | date: | 2022-07-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-015426 | date: | 2023-09-27T01:07:00 |
| db: | CNNVD | id: | CNNVD-202207-384 | date: | 2022-07-26T00:00:00 |
| db: | NVD | id: | CVE-2021-41031 | date: | 2022-07-25T14:30:34.517 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-402301 | date: | 2022-07-18T00:00:00 |
| db: | JVNDB | id: | JVNDB-2022-015426 | date: | 2023-09-27T00:00:00 |
| db: | CNNVD | id: | CNNVD-202207-384 | date: | 2022-07-05T00:00:00 |
| db: | NVD | id: | CVE-2021-41031 | date: | 2022-07-18T18:15:08.867 |