FortiClient VPN Client Password Disclosure Vulnerability

A vulnerability has been identified in FortiClient VPN Client, which can be exploited by remote user to obtain the target user's VPN password. A remote user that can conduct a man-in-the-middle attack and cause the VPN client to connect to a proxy server can obtain the target user's VPN password. The VPN client correctly detects that the SSL certificate is not correct but sends the target user's VPN password before warning the target user of the incorrect SSL certificate.