Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2024-31489

AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and Forti

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiGate and the FortiClient during the ZTNA tunnel creation

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiClientMac

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.4affected
  • 7.0.0 to ≤ 7.0.11affected

Fortinet FortiClientEMS

Default version status: unaffected

  • 7.0.0 to ≤ 7.0.13affected

Fortinet FortiClientLinux

Default version status: unaffected

  • 7.2.0affected
  • 7.0.0 to ≤ 7.0.11affected

Fortinet FortiClientWindows

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.2affected
  • 7.0.0 to ≤ 7.0.11affected

References