CVE-2023-33304

A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-23-108	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:forticlient::::::windows::*
	cpe:2.3:a:fortinet:forticlient:7.2.0:::::windows::
	cpe:2.3:a:fortinet:forticlient:7.2.1:::::windows::

History

20 Nov 2023, 18:19

Type	Values Removed	Values Added
First Time		Fortinet Fortinet forticlient
CPE		cpe:2.3:a:fortinet:forticlient:7.2.0:::::windows:: cpe:2.3:a:fortinet:forticlient:7.2.1:::::windows:: cpe:2.3:a:fortinet:forticlient::::::windows::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~() https://fortiguard.com/psirt/FG-IR-23-108 -~~	() https://fortiguard.com/psirt/FG-IR-23-108 - Vendor Advisory

14 Nov 2023, 18:51

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-14 18:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-33304

Mitre link : CVE-2023-33304

CVE.ORG link : CVE-2023-33304

JSON object : View

Products Affected

fortinet

forticlient

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2023-33304", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2023-11-14T18:15:30.133", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-108", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials."}, {"lang": "es", "value": "Un uso de vulnerabilidad de credenciales codificadas en Fortinet FortiClient Windows 7.0.0 - 7.0.9 y 7.2.0 - 7.2.1 permite a un atacante omitir las protecciones del sistema mediante el uso de credenciales est\u00e1ticas."}], "lastModified": "2023-11-20T18:19:34.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "8E16F30C-4167-462E-B67E-6B8A449CC591", "versionEndIncluding": "7.0.9", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:forticlient:7.2.0:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "CEC62C6E-AA05-4AE9-86C5-47D6763206AF"}, {"criteria": "cpe:2.3:a:fortinet:forticlient:7.2.1:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "E3CFBB37-3186-43F8-B513-FBFFAA1B9DCF"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}