CVE-2023-37939: Infoleak
First published: Tue Oct 10 2023(Updated: )
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning.
Credit: psirt@fortinet.com psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet Forticlient | >=6.2.0<=6.2.9 | |
| Fortinet Forticlient | >=6.2.0<=6.2.9 | |
| Fortinet FortiClient Windows | >=6.2.0<=6.2.9 | |
| Fortinet Forticlient | >=6.4.0<=6.4.9 | |
| Fortinet Forticlient | >=6.4.0<=6.4.10 | |
| Fortinet FortiClient Windows | >=6.4.0<=6.4.10 | |
| Fortinet Forticlient | >=7.0.0<=7.0.9 | |
| Fortinet Forticlient | >=7.0.0<=7.0.9 | |
| Fortinet FortiClient Windows | >=7.0.0<=7.0.9 | |
| Fortinet Forticlient | =7.2.0 | |
| Fortinet Forticlient | =7.2.0 | |
| Fortinet FortiClient Windows | =7.2.0 | |
| Fortinet Forticlient | =7.2.1 |
Remedy
Please upgrade to FortiClientMac version 7.2.2 or above Please upgrade to FortiClientWindows version 7.2.1 or above Please upgrade to FortiClientLinux version 7.2.1 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-37939.
What is the severity of CVE-2023-37939?
The severity of CVE-2023-37939 is low.
Which software versions are affected by CVE-2023-37939?
FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions are affected by CVE-2023-37939.
What is the vulnerability type of CVE-2023-37939?
CVE-2023-37939 is classified as an exposure of sensitive information to an unauthorized actor vulnerability [CWE-200].
How can I fix CVE-2023-37939?
There is no official fix available at the moment. It is recommended to closely monitor the vendor's website for any updates or patches to address this vulnerability.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/fortinet
- canonical/fortinet forticlient
- version/fortinet forticlient/6.2.0
- version/fortinet forticlient/6.2.9
- canonical/fortinet forticlient windows
- version/fortinet forticlient windows/6.2.0
- version/fortinet forticlient windows/6.2.9
- version/fortinet forticlient/6.4.0
- version/fortinet forticlient/6.4.9
- version/fortinet forticlient/6.4.10
- version/fortinet forticlient windows/6.4.0
- version/fortinet forticlient windows/6.4.10
- version/fortinet forticlient/7.0.0
- version/fortinet forticlient/7.0.9
- version/fortinet forticlient windows/7.0.0
- version/fortinet forticlient windows/7.0.9
- version/fortinet forticlient/7.2.0
- version/fortinet forticlient windows/7.2.0
- version/fortinet forticlient/7.2.1