PSIRTPath Traversal in agent leads to Privilege Escalation
Summary
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiDLP Agent's Outlookproxy plugin for Windows and MacOS may allow an authenticated attacker to escalate their privileges to LocalService or Root privilege via sending a crafted request to a local listening port.
| Version | Affected | Solution |
|---|---|---|
| FortiDLP 12.1 | Not affected | Not Applicable |
| FortiDLP 12.0 | Not affected | Not Applicable |
| FortiDLP 11.5 | 11.5 all versions | Migrate to a fixed release |
| FortiDLP 11.4 | 11.4 all versions | Migrate to a fixed release |
| FortiDLP 11.3 | 11.3 all versions | Migrate to a fixed release |
| FortiDLP 11.2 | 11.2 all versions | Migrate to a fixed release |
| FortiDLP 11.1 | 11.1 all versions | Migrate to a fixed release |
| FortiDLP 11.0 | 11.0 all versions | Migrate to a fixed release |
| FortiDLP 10.5 | 10.5 all versions | Migrate to a fixed release |
| FortiDLP 10.4 | 10.4 all versions | Migrate to a fixed release |
| FortiDLP 10.3 | 10.3 all versions | Migrate to a fixed release |
| FortiDLP 6.0 | Not affected | Not Applicable |