description: A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions,  6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade.
problem types: Escalation of privilege
affected:
{
vendor: Fortinet
product: FortiClientMac
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.7, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.9, status: affected
versionType: semver, version: 6.0.1, lessThanOrEqual: 6.0.10, status: affected
versionType: semver, version: 5.6.5, lessThanOrEqual: 5.6.6, status: affected
version: 5.6.3, status: affected
versionType: semver, version: 5.6.0, lessThanOrEqual: 5.6.1, status: affected
versionType: semver, version: 5.4.0, lessThanOrEqual: 5.4.4, status: affected
versionType: semver, version: 5.2.0, lessThanOrEqual: 5.2.6, status: affected
versionType: semver, version: 5.0.0, lessThanOrEqual: 5.0.10, status: affected
versionType: semver, version: 4.0.0, lessThanOrEqual: 4.0.3, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:X
]
solutions: Please upgrade to  FortiClientMac version 7.0.8 or above.
Please upgrade to  FortiClientMac version 7.2.0 or above.