Open Redirect Weakness in Fortinet FortiAnalyzer and FortiManager
CVE-2017-3126

6.1MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Fortianalyzer, Fortimanager
Vendor
CVE Published:
27 May 2017

Summary

An Open Redirect vulnerability exists in Fortinet’s FortiAnalyzer versions 5.4.0 to 5.4.2 and FortiManager versions 5.4.0 to 5.4.2. This flaw can be exploited by attackers to redirect users to malicious websites, allowing them to execute unauthorized code or commands through manipulation of the 'next' parameter. Organizations using these versions should take immediate steps to patch the vulnerability to mitigate potential security risks.

Affected Version(s)

Fortinet FortiAnalyzer, FortiManager FortiAnalyzer 5.4.2, 5.4.1, 5.4.0

Fortinet FortiAnalyzer, FortiManager FortiManager 5.4.2, 5.4.1, 5.4.0

References

http://www.securitytracker.com/id/1038540
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/98557
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1038539
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.