PT-2016-6198 · Fortinet · Fortiwan

Fan-Syun Shih + 2 · Publicado 2016-09-21 · Atualizado 2016-09-21 · CVE-2016-4966

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiWan versions prior to 4.2.5

Description The issue concerns the diagnosis control.php page, where remote authenticated users can download PCAP files. This is related to the UserName GET parameter.

Recommendations For versions prior to 4.2.5, update to version 4.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the diagnosis control.php page until the update is applied. Avoid using the UserName parameter in the affected page to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2016-4966

Produtos afetados

Fortiwan

Referências · 6

• https://kb.cert.org/vuls/id/724487 · Nota
• http://securityfocus.com/bid/92781 · Nota
• http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdf · Nota
• https://osv.dev/vulnerability/CVE-2016-4966 · Aviso do Fabricante
• http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4966 · Nota de Segurança