PT-2019-5812 · Fortinet · Fortios

Publicado 2019-05-17 · Atualizado 2020-01-03 · CVE-2018-13384

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions prior to 6.0.5

Description A Host Header Redirection issue allows a remote attacker to potentially poison HTTP cache and redirect SSL VPN web portal users to arbitrary web domains. This is achieved by submitting specially crafted HTTP requests to the SSL-VPN web portal, which may respond with a redirection to attacker-specified websites. If a web proxy's cache is poisoned with this redirection, users may be directed to the attacker's specified websites when trying to access the SSL-VPN web portal.

Recommendations For versions prior to 6.0.5, update to version 6.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSL-VPN web portal to minimize the risk of exploitation. Additionally, avoid using web proxies that may have cached the malicious redirection until the issue is resolved.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

BDU:2021-03019

CVE-2018-13384

Produtos afetados

Fortios

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-13384 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13384 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-03019 · Nota de Segurança
• https://fortiguard.com/advisory/FG-IR-19-002 · Aviso do Fabricante
• https://t.me/cibsecurity/4682 · Publicação no Telegram
• https://cxsecurity.com/cveshow/CVE-2018-13384 · Nota