PT-2018-1709 · Fortinet · Fortios

Published 2018-05-07 · Updated 2018-08-27 · CVE-2018-9185

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0.0 and below

Description: An information disclosure issue in FortiOS reveals a user's web portal login credentials in a Javascript file sent to the client-side when pages bookmarked in the web portal use the Single Sign-On feature. This could potentially allow a remote attacker to disclose user credentials if additional vulnerabilities, such as session handling, access control, or cross-site scripting issues, are discovered in the SSL-VPN web portal or in the applications within, or in case of client-side vulnerabilities, in the user's browser.

Recommendations: For FortiOS versions 6.0.0 and below, consider disabling the Single Sign-On feature in the web portal as a temporary workaround until a patch is available. Restrict access to the SSL-VPN web portal to minimize the risk of exploitation. Avoid using the bookmark feature in the web portal for pages that use Single Sign-On until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2018-01275

CVE-2018-9185

Affected Products

Fortios

References · 8

• https://bdu.fstec.ru/vul/2018-01275 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-9185 · Security Note
• https://fortiguard.com/advisory/FG-IR-18-027 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9185 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-18-027 · Note
• http://securitytracker.com/id/1041186 · Note
• http://securityfocus.com/bid/104535 · Note
• https://securityfocus.com/bid/104535 · Note