FG-IR-23-087: [FortiClient Linux] Remote Code Execution due to dangerous nodejs configuration
Published Apr 9, 2024
·Updated
An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientLinux may allow##an unauthenticated attacker to execute arbitrary code via tricking a FortiClientLinux user into visiting a malicious website.
Affected Software
3 affected componentsFixes available
Fortinet FortiClientLinux=.
Fortinet FortiClientLinux>=7.0.6<=7.0.10
Fortinet FortiClientLinux>=7.0.3<=7.0.4
Event History
Apr 9, 2024
Advisory Published
via FortiGuard·12:00 AM
Frequently Asked Questions
1
What is the severity of FG-IR-23-087?
The severity of FG-IR-23-087 is high due to its potential to allow arbitrary code execution.
2
How do I fix FG-IR-23-087?
To fix FG-IR-23-087, update FortiClientLinux to versions 7.2.1 or 7.0.11 or later.
3
Who is affected by FG-IR-23-087?
Users of FortiClientLinux versions prior to 7.2.1 and specific 7.0.x versions are affected by FG-IR-23-087.
4
What type of vulnerability is FG-IR-23-087?
FG-IR-23-087 is categorized as a Code Injection vulnerability (CWE-94).
5
Can FG-IR-23-087 be exploited remotely?
Yes, FG-IR-23-087 can be exploited remotely by tricking users into visiting malicious websites.