Unquoted Service Path Exploit observed in FortiSIEMWindowsAgent
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-20-021
Final
1
1
2020-06-03T00:00:00
Current version
2020-06-03T00:00:00
2020-06-03T00:00:00
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
Escalation of privilege
FortiSIEMWindowsAgent version 3.1.2 and below.
Please upgrade to FortiSIEMWindowsAgent version 3.2.0 or above.
Fortinet is pleased to thank Huw Pigott from Shearwater, a CyberCX company, for reporting this vulnerability under responsible disclosure.
FortiSIEMWindowsAgent 3.1.3
FortiSIEMWindowsAgent 3.1.2
Unquoted Service Path Exploit observed in FortiSIEMWindowsAgent
CVE-2020-9292
FortiSIEMWindowsAgent-3.1.3
FortiSIEMWindowsAgent-3.1.2
6.2
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X
https://fortiguard.fortinet.com/psirt/FG-IR-20-021
Unquoted Service Path Exploit observed in FortiSIEMWindowsAgent
Reference>