PT-2021-9843 · Fortinet · Fortigate+1

Published 2021-01-21 · Updated 2021-03-11 · CVE-2020-15938

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions FortiGate versions prior to 6.2.5 FortiGate versions prior to 6.4.2

Description The issue occurs when non-HTTP/S traffic, such as SSH traffic, passes through the FortiGate on ports 80/443. This traffic is not redirected to the transparent proxy policy for processing because it lacks a valid HTTP header.

Recommendations For versions prior to 6.2.5, update to version 6.2.5 or later to resolve the issue. For versions prior to 6.4.2, update to version 6.4.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2020-15938

Affected Products

Fortigate

Fortios

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-15938 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15938 · Vendor Advisory
• https://fortiguard.com/advisory/FG-IR-20-172 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15938 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-20-172 · Note
• https://fortiguard.com/psirt/FG-IR-20-172 · Note