{"containers": {"cna": {"affected": [{"product": "FortiClient for Windows", "vendor": "Fortinet, Inc.", "versions": [{"status": "affected", "version": "5.6.0 and below versions"}]}, {"product": "FortiClient for Mac OSX", "vendor": "Fortinet, Inc.", "versions": [{"status": "affected", "version": "5.6.0 and below versions"}]}, {"product": "FortiClient SSLVPN Client for Linux", "vendor": "Fortinet, Inc.", "versions": [{"status": "affected", "version": "4.4.2335 and below versions"}]}], "datePublic": "2017-12-07T00:00:00", "descriptions": [{"lang": "en", "value": "Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms."}], "problemTypes": [{"descriptions": [{"description": "Information Disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-05-02T15:27:54", "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://fortiguard.com/advisory/FG-IR-17-214"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@fortinet.com", "DATE_PUBLIC": "2017-12-07T00:00:00", "ID": "CVE-2017-17543", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "FortiClient for Windows", "version": {"version_data": [{"version_value": "5.6.0 and below versions"}]}}, {"product_name": "FortiClient for Mac OSX", "version": {"version_data": [{"version_value": "5.6.0 and below versions"}]}}, {"product_name": "FortiClient SSLVPN Client for Linux", "version": {"version_data": [{"version_value": "4.4.2335 and below versions"}]}}]}, "vendor_name": "Fortinet, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information Disclosure"}]}]}, "references": {"reference_data": [{"name": "https://fortiguard.com/advisory/FG-IR-17-214", "refsource": "CONFIRM", "url": "https://fortiguard.com/advisory/FG-IR-17-214"}]}}}}, "cveMetadata": {"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "assignerShortName": "fortinet", "cveId": "CVE-2017-17543", "datePublished": "2017-12-07T00:00:00", "dateReserved": "2017-12-11T00:00:00", "dateUpdated": "2020-05-02T15:27:54", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*", "matchCriteriaId": "05C9130B-9139-407F-B6F9-9B64A8B830D6", "versionEndIncluding": "5.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:macos:*:*", "matchCriteriaId": "6DA8975F-A2E7-47D2-83BA-6990673124BC", "versionEndIncluding": "5.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient_sslvpn_client:*:*:*:*:*:linux:*:*", "matchCriteriaId": "B0DB26D0-44AA-4958-A926-B6BDCAA9402A", "versionEndIncluding": "4.4.2335", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms."}, {"lang": "es", "value": "Las credenciales de autenticaci\u00f3n de VPN de los usuarios se cifran de manera no segura en Fortinet FortiClient para Windows en versiones 5.6.0 y anteriores, FortiClient para Mac OSX en versiones 5.6.0 y anteriores y FortiClient SSLVPN Client para Linux en versiones 4.4.2335 y anteriores, debido a la uso de una clave de cifrado est\u00e1tico y algoritmos de cifrado d\u00e9biles."}], "id": "CVE-2017-17543", "lastModified": "2020-05-11T17:38:32.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-26T20:29:00.243", "references": [{"source": "psirt@fortinet.com", "url": "https://fortiguard.com/advisory/FG-IR-17-214"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}