{"containers": {"cna": {"affected": [{"product": "Fortinet FortiClientLinux", "vendor": "Fortinet", "versions": [{"status": "affected", "version": "FortiClientLinux 6.2.1 and below"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted \"ExportLogs\" type IPC client requests to the fctsched process."}], "problemTypes": [{"descriptions": [{"description": "Escalation of privilege", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-07T16:04:42", "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://fortiguard.com/psirt/FG-IR-19-238"}, {"tags": ["x_refsource_MISC"], "url": "https://danishcyberdefence.dk/blog/forticlient_linux"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@fortinet.com", "ID": "CVE-2019-15711", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Fortinet FortiClientLinux", "version": {"version_data": [{"version_value": "FortiClientLinux 6.2.1 and below"}]}}]}, "vendor_name": "Fortinet"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted \"ExportLogs\" type IPC client requests to the fctsched process."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Escalation of privilege"}]}]}, "references": {"reference_data": [{"name": "https://fortiguard.com/psirt/FG-IR-19-238", "refsource": "CONFIRM", "url": "https://fortiguard.com/psirt/FG-IR-19-238"}, {"name": "https://danishcyberdefence.dk/blog/forticlient_linux", "refsource": "MISC", "url": "https://danishcyberdefence.dk/blog/forticlient_linux"}]}}}}, "cveMetadata": {"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "assignerShortName": "fortinet", "cveId": "CVE-2019-15711", "datePublished": "2020-02-06T15:10:07", "dateReserved": "2019-08-27T00:00:00", "dateUpdated": "2020-02-07T16:04:42", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:linux:*:*", "matchCriteriaId": "E48E9C78-9690-4FC2-86A8-290DF7321A57", "versionEndIncluding": "6.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege via injecting specially crafted \"ExportLogs\" type IPC client requests to the fctsched process."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios en FortiClient para Linux versiones 6.2.1 y posteriores, puede permitir a un usuario con privilegios bajos ejecutar comandos del sistema con privilegios de root mediante una inyecci\u00f3n de peticiones del cliente IPC de tipo \"ExportLogs\" especialmente dise\u00f1adas hacia el proceso fctsched."}], "id": "CVE-2019-15711", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-06T16:15:12.213", "references": [{"source": "psirt@fortinet.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://danishcyberdefence.dk/blog/forticlient_linux"}, {"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.com/psirt/FG-IR-19-238"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}