CVE-2022-33878

CWE-200 — Information Exposure CWE-532 — Log File Information Exposure4 documents4 sources

Severity

5.5MEDIUM

EPSS

0.1%

top 65.51%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Forticlient Fortinet Fortinet Forticlientmac

Timeline

PublishedNov 2

Description

An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local authenticated attacker to obtain the SSL-VPN password in cleartext via running a logstream for the FortiTray process in the terminal.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:NExploitability: 0.8 | Impact: 1.4

Affected Packages2 packages

▶NVDfortinet/forticlient7.0.0 — 7.0.5

▶CVEListV5fortinet/fortinet_forticlientmacFortiClientMac 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

CVEList

CVE-2022-33878: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7↗2022-11-02

▶

GHSA

GHSA-26mw-3pv7-3gqf: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7↗2022-11-02

▶

📋Vendor Advisories

Fortinet

An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7...↗2022-11-02

▶