Skip to main content

Credentials Management Errors


Severity Medium
Score 5.4/10


FortiClient before on Windows, before on Mac OS X, and before 4.0 on Android; FortiClient Lite before on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid, which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.

  • HIGH
  • NONE
  • NONE
  • NONE

CWE-255 - Credentials Management Errors

Weaknesses in this category are related to the management of credentials.


Advisory Timeline

  • Published