PT-2017-3354 · Fortinet · Fortiwebmanager

Publicado 2017-11-22 · Atualizado 2019-10-03 · CVE-2017-14189

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWebManager version 5.8.0

Description The issue is related to an improper access control in the admin webUI, allowing unauthorized access to the system using the admin account, regardless of the password provided. This can be exploited by a remote attacker with access to the web interface, potentially leading to unauthorized system access.

Recommendations For FortiWebManager version 5.8.0, consider restricting access to the admin webUI until a fix is available. As a temporary workaround, limit the use of the admin account to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-521

Identificadores relacionados

BDU:2018-00125

CVE-2017-14189

Produtos afetados

Fortiwebmanager

Referências · 6

• http://securitytracker.com/id/1039892 · Nota
• https://fortiguard.com/advisory/FG-IR-17-248 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00125 · Nota de Segurança
• http://securityfocus.com/bid/101953 · Nota
• https://osv.dev/vulnerability/CVE-2017-14189 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14189 · Nota de Segurança