PT-2018-2863 · Fortinet · Fortios

Publicado 2018-11-22 · Atualizado 2019-10-03 · CVE-2018-13376

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 5.2 through 5.6.3 Fortinet FortiOS versions 5.4.6 through 5.4.7

Description The issue is related to an uninitialized memory buffer leak in the web proxy's disclaimer response web pages. This could potentially cause sensitive data to be displayed in the HTTP response. The vulnerability is associated with resource management errors, which could allow a remote attacker to disclose protected information.

Recommendations For Fortinet FortiOS versions 5.2 through 5.6.3, consider disabling the web proxy's disclaimer response web pages until a patch is available. For Fortinet FortiOS versions 5.4.6 through 5.4.7, restrict access to the web proxy to minimize the risk of exploitation. As a temporary workaround, avoid using the web proxy's disclaimer response web pages in Fortinet FortiOS until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2019-02389

CVE-2018-13376

Produtos afetados

Fortios

Referências · 9

• 🔥 https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180031.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13376 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-18-325 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02389 · Nota de Segurança
• https://securityfocus.com/bid/106036/info · Nota
• https://vuldb.com/?id.127208 · Nota
• http://securityfocus.com/bid/106036 · Nota
• https://osv.dev/vulnerability/CVE-2018-13376 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-18-325 · Nota