CVE-2022-45856
Description
An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all versions, 7.0 all versions, 7.2.0 and FortiClientiOS 5.6 all versions, 6.0.0 through 6.0.1, 7.0.0 through 7.0.6 SAML SSO feature may allow an unauthenticated attacker to man-in-the-middle the communication between the FortiClient and both the service provider and the identity provider.
How to fix
- fortinet forticlient7.2.1, 7.2.5, 7.0.8, 7.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet forticlient | 5.0 ≤ v < 7.2.1, 6.4 ≤ v < 7.2.5, 6.4 ≤ v < 7.0.8, 2.0 ≤ v < 7.0.7 | 7.2.1, 7.2.5, 7.0.8, 7.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.