description: An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links.
problem types: Information disclosure
affected:
{
product: Fortinet FortiClientLinux
vendor: Fortinet
versions:
status: affected, version: FortiClientLinux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: WORKAROUND
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 6.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:W/RC:C
version: 3.1
]