Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-45590
CVE-2023-45590:
FortiClient vulnerability analysis and mitigation
Overview
An Improper Control of Generation of Code ('Code Injection') vulnerability in FortiClientLinux was discovered and assigned CVE-2023-45590. The vulnerability affects FortiClientLinux versions 7.2.0, 7.0.6 through 7.0.10, and 7.0.3 through 7.0.4. This critical security flaw was initially published on April 9, 2024, and was discovered by security researcher CataLpa from Dbappsecurity Co. Ltd (Fortiguard PSIRT).
Technical details
The vulnerability is classified as a critical severity issue with a CVSS score of 9.4 out of 10. It stems from a dangerous ELECTRONJS configuration that allows for improper control of code generation. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code) and enables code injection attacks (CERT-EU, Fortiguard PSIRT).
Impact
The vulnerability allows an unauthenticated attacker to execute arbitrary code on affected systems. This remote code execution capability poses a significant risk to system security and integrity, as it enables attackers to run unauthorized code or commands on the target system (Hacker News, Fortiguard PSIRT).
Mitigation and workarounds
Fortinet has released security patches to address this vulnerability. Users of FortiClientLinux 7.2.0 should upgrade to version 7.2.1 or above, while users of versions 7.0.3 through 7.0.4 and 7.0.6 through 7.0.10 should upgrade to version 7.0.11 or above. Version 7.4 is not affected by this vulnerability (Fortiguard PSIRT).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management