CVE-2013-4669

 

Published at: - 25-06-2013 04:38

Last modified: - 23-01-2023 07:44

Total changes: - 9

Description

FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:H/Au:N/C:C/I:N/A:N

 

Verification logic

 

Reference

• http://www.fortiguard.com/advisory/Potential-Man-In-The-Middle-Vulnerability-in-FortiClient-VPN/
• 20130501 Forticlient VPN client credential interception vulnerability-
• 59604-
• http://objectif-securite.ch/forticlient_bulletin.php

 

Keywords

NVD

 

CVE-2013-4669

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures