A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiClientWindows 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13 and FortiClientLinux 7.4.0 through 7.4.2, 7.2.0 through 7.2.7, 7.0.0 through 7.0.13 may permit a local authenticated user to retrieve VPN password via memory dump, due to JavaScripts garbage collector
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Forticlient | Fortinet | 7.0.0 (including) | 7.0.14 (excluding) |
| Forticlient | Fortinet | 7.0.0 (including) | 7.2.8 (excluding) |
| Forticlient | Fortinet | 7.2.0 (including) | 7.2.7 (excluding) |
| Forticlient | Fortinet | 7.4.0 (including) | 7.4.2 (excluding) |
| Forticlient | Fortinet | 7.4.0 (including) | 7.4.3 (excluding) |