Improper Access Control in Fortinet FortiWebManager Affects Administrators
CVE-2017-14189

9.8CRITICAL

Key Information:

Vendor
Fortinet
Status
Fortiwebmanager
Vendor
CVE Published:
29 November 2017

Summary

An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 enables unauthorized users to log in to the admin web UI without valid credentials, posing significant security risks. This flaw can lead to complete administrative access, allowing potential attackers to manipulate settings or extract sensitive information without the need for authentication.

Affected Version(s)

FortiWebManager 5.8.0

References

http://www.securityfocus.com/bid/101953
vdb-entryx_refsource_BID
https://fortiguard.com/advisory/FG-IR-17-248
x_refsource_CONFIRM
http://www.securitytracker.com/id/1039892
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.