PT-2019-4120 · Fortinet · Fortios

Published 2019-07-26 · Updated 2025-10-01 · CVE-2019-5591

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS (affected versions not specified)

Description A default configuration issue in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. The issue relates to authorization errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Missing Authentication

Improper Authorization

Weakness Enumeration

CWE-345

CWE-306

CWE-285

Related Identifiers

BDU:2019-04699

CVE-2019-5591

Affected Products

Fortios

References · 24

• 🔥 https://github.com/ayewo/fortios-ldap-mitm-poc-CVE-2019-5591 · Exploit
• https://fortiguard.com/psirt/FG-IR-19-037 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04699 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5591 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5591 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-5591 · Security Note
• https://twitter.com/DefusedCyber/status/1934845933671362944 · Twitter Post
• https://t.me/cvenotify/99333 · Telegram Post
• https://twitter.com/DefusedCyber/status/1954797630862540948 · Twitter Post
• https://t.me/defcon_news/72923 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://twitter.com/DefusedCyber/status/1947894911690260716 · Twitter Post
• https://twitter.com/DefusedCyber/status/1972613327919501597 · Twitter Post
• https://t.me/aptreports/745 · Telegram Post
• https://t.me/cibsecurity/14145 · Telegram Post