« Volver al listado

CVE-2023-45590

Estado: AnalizadaAlta (8.8)—

An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Forticlient

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45590",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45590",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-11T04:01:08.566633Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiClientLinux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0"
            },
            {
              "status": "affected",
              "version": "7.0.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.10"
            },
            {
              "status": "affected",
              "version": "7.0.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*"
          ],
          "vendor": "fortinet",
          "product": "forticlient",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.0.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "7.0.3",
              "lessThan": "7.0.4",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlient:7.2.0:*:*:*:*:linux:*:*"
          ],
          "vendor": "fortinet",
          "product": "forticlient",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-04-09T15:15:27.627",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-087",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-087",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website"
    },
    {
      "lang": "es",
      "value": "Un control inadecuado de la generación de código (\"inyección de código\") en Fortinet FortiClientLinux versión 7.2.0, 7.0.6 a 7.0.10 y 7.0.3 a 7.0.4 permite a un atacante ejecutar código o comandos no autorizados engañando a un usuario de FortiClientLinux para que visitar un sitio web malicioso"
    }
  ],
  "lastModified": "2026-06-17T06:28:52.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A39CBD1-AAF7-4423-AA29-840CF0DBFD6E",
              "versionEndExcluding": "7.0.11",
              "versionStartIncluding": "7.0.6"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.0.3:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14320E4A-2445-4930-A8D1-B768B7294B36"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.0.4:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56EE5E2F-CB22-4294-9AA9-DDB344494D9B"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:7.2.0:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88271718-0DD4-4717-B403-1B44E2E56C91"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}