CVE-2013-4669

Loading...

General

Score:5.4/10.0
Severity:Medium
Category:Access Management Error
Exploit:Available

Impact Metrics

Confidentiality:Complete
Integrity:None
Availability:None

Exploitability Metrics

Access Vector:Network
Access Complexity:High
Authentication:None

Published on 25/06/13 - Updated on 04/11/15

Description

FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.

Category: Access Management Error

CWE-255 (Credentials Management)
Weaknesses in this category are related to the management of credentials.

Security Notices

US National Vulnerability DatabaseCVE-2013-4669

Exploits

SecurityFocusBID-59604

Relative technologies

VendorProduct
fortinetforticlient
fortinetforticlient_lite
fortinetforticlient_ssl_vpn

Share this vulnerability with:

Twitter Facebook LinkedIn Mail