description: An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConverter is installed in an insecure folder.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiConverter
defaultStatus: unaffected
versions:
version: 7.0.0, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.1, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.3, status: affected
}
{
vendor: Fortinet
product: FortiClientWindows
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.6, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.8, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X
]
solutions: Please upgrade to FortiClientWindows version 7.0.7 or above
Please upgrade to FortiClientWindows version 6.4.9 or above
Please upgrade to FortiConverter version 7.0.1 or above
Please upgrade to FortiConverter version 6.2.2 or above