CVE-2024-50570
First published: Wed Dec 18 2024(Updated: )
A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScript's garbage collector
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiClient Virtual Private Network | >=7.4.0<=7.4.1>=7.2.0<=7.2.6>=7.0.0<=7.0.13 | |
| Fortinet FortiClient Virtual Private Network | >=7.4.0<=7.4.2>=7.2.0<=7.2.7>=7.0.0<=7.0.13 |
Remedy
Please upgrade to FortiClientLinux version 7.4.3 or above Please upgrade to FortiClientLinux version 7.2.8 or above Please upgrade to FortiClientLinux version 7.0.14 or above Please upgrade to FortiClientWindows version 7.4.2 or above Please upgrade to FortiClientWindows version 7.2.7 or above Please upgrade to FortiClientWindows version 7.0.14 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-50570?
CVE-2024-50570 has been classified as a moderate severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2024-50570?
To fix CVE-2024-50570, upgrade FortiClient to version 7.4.2 or later, or 7.2.7 or later, or 7.0.13 or later.
Who is affected by CVE-2024-50570?
CVE-2024-50570 affects users of FortiClient versions 7.4.0 to 7.4.1, 7.2.0 to 7.2.6, and 7.0.0 to 7.0.13 for both Windows and Linux platforms.
What is the impact of exploiting CVE-2024-50570?
Exploitation of CVE-2024-50570 may allow a local authenticated user to retrieve stored VPN passwords, leading to potential unauthorized access.
Is CVE-2024-50570 a remote or local vulnerability?
CVE-2024-50570 is classified as a local vulnerability, requiring authenticated access to the affected systems.
- agent/weakness
- agent/remedy
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet forticlient virtual private network