{"id":"CVE-2023-37939","state":"PUBLISHED","title":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux ","description":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning.","publishedAt":"2023-10-10T16:50:04.463Z","updatedAt":"2024-09-18T20:26:45.399Z","severity":{"score":3,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiClientMac","Fortinet FortiClientWindows","Fortinet FortiClientLinux"],"affected":[{"vendor":"Fortinet","product":"FortiClientMac","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.10","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiClientWindows","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.10","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiClientLinux","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.6","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.4","versionType":"semver"},{"version":"6.4.7","status":"affected","lessThanOrEqual":"6.4.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.2.6","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-235"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/37xxx/CVE-2023-37939.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-37939","state":"PUBLISHED","datePublished":"2023-10-10T16:50:04.463Z","dateUpdated":"2024-09-18T20:26:45.399Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-07-11T08:16:54.093Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning."}],"affected":[{"vendor":"Fortinet","product":"FortiClientMac","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.1","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.10","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiClientWindows","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.10","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiClientLinux","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected"},{"version":"7.0.6","status":"affected","lessThanOrEqual":"7.0.9","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.4","versionType":"semver"},{"version":"6.4.7","status":"affected","lessThanOrEqual":"6.4.9","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.2.6","status":"affected","lessThanOrEqual":"6.2.9","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-235","name":"https://fortiguard.com/psirt/FG-IR-22-235"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-10-10T16:50:04.463Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiClientMac version 7.2.2 or above Please upgrade to FortiClientWindows version 7.2.1 or above Please upgrade to FortiClientLinux version 7.2.1 or above "}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-235","name":"https://fortiguard.com/psirt/FG-IR-22-235","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T17:23:27.759Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-18T20:26:36.640081Z","id":"CVE-2023-37939","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-18T20:26:45.399Z"}}]}}}