PT-2017-17671 · Fortinet · Fortiportal

Publicado 2017-05-26 · Atualizado 2019-10-03 · CVE-2017-7337

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiPortal versions 4.0.0 and below

Description The issue is related to improper Access Control, allowing an attacker to interact with unauthorized VDOMs or enumerate other ADOMs. This can be achieved via another user's stolen session and CSRF tokens or by exploiting the adomName parameter in the "/fpc/sec/customer/policy/getAdomVersion" API endpoint.

Recommendations For Fortinet FortiPortal versions 4.0.0 and below, consider restricting access to the "/fpc/sec/customer/policy/getAdomVersion" API endpoint and ensure proper session and CSRF token management to prevent unauthorized interactions. Additionally, limit the use of the adomName parameter to minimize the risk of ADOM enumeration.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-7337

Produtos afetados

Fortiportal

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-7337 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7337 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-17-114 · Aviso do Fabricante