PT-2017-17671 · Fortinet · Fortiportal

Published 2017-05-26 · Updated 2019-10-03 · CVE-2017-7337

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiPortal versions 4.0.0 and below

Description The issue is related to improper Access Control, allowing an attacker to interact with unauthorized VDOMs or enumerate other ADOMs. This can be achieved via another user's stolen session and CSRF tokens or by exploiting the adomName parameter in the "/fpc/sec/customer/policy/getAdomVersion" API endpoint.

Recommendations For Fortinet FortiPortal versions 4.0.0 and below, consider restricting access to the "/fpc/sec/customer/policy/getAdomVersion" API endpoint and ensure proper session and CSRF token management to prevent unauthorized interactions. Additionally, limit the use of the adomName parameter to minimize the risk of ADOM enumeration.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-7337

Affected Products

Fortiportal

References · 3

• https://osv.dev/vulnerability/CVE-2017-7337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7337 · Security Note
• https://fortiguard.com/psirt/FG-IR-17-114 · Vendor Advisory