PT-2018-3770 · Fortinet · Fortios

Publicado 2018-08-23 · Atualizado 2019-05-30 · CVE-2018-13365

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.1, 5.6.5 and below

Description The issue is related to insufficient protection of service data on the Application control block page of FortiOS, allowing a remote attacker to gain unauthorized access to protected information. This can lead to the exposure of private IP addresses and hostnames of FortiGate devices via the Application Control Block page. The default replacement message on this page reveals sensitive information.

Recommendations For FortiOS versions 6.0.1 and below, consider restricting access to the Application Control Block page until a fix is available. For FortiOS version 5.6.5 and below, restrict access to the Application Control Block page to minimize the risk of exploitation. As a temporary workaround, consider disabling the default replacement message on the Application Control Block page to prevent information exposure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2021-06281

CVE-2018-13365

Produtos afetados

Fortios

Referências · 5

• https://fortiguard.com/psirt/FG-IR-18-085 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-13365 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-06281 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-18-085 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-13365 · Aviso do Fabricante