VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 25, 2013· Updated Jun 16, 2026

CVE-2013-4669

CVE-2013-4669

Description

FortiClient before 4.3.5.472 on Windows, before 4.0.3.134 on Mac OS X, and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.

Affected products

6
  • Fortinet/Forticlient2 versions
    cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:*:*:*range: <=4.3.3.445
    • (no CPE)range: Windows: <4.3.5.472; Mac OS X: <4.0.3.134; Android: <4.0
  • Fortinet/Forticlient Lite2 versions
    cpe:2.3:a:fortinet:forticlient_lite:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fortinet:forticlient_lite:*:*:*:*:*:*:*:*range: <=4.3.3.445
    • (no CPE)range: Windows: <4.3.4.461; Android: 2.0 through 2.0.0223
  • Fortinet/Forticlient Sslvpn Client2 versions
    cpe:2.3:a:fortinet:forticlient_ssl_vpn:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:fortinet:forticlient_ssl_vpn:*:*:*:*:*:*:*:*range: <=4.0.2012
    • (no CPE)range: Linux: <4.0.2258

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.