Cross-Site WebSocket Hijacking Vulnerability in FortiManager by Fortinet
CVE-2019-17654

8.8HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Fortimanager
Vendor
CVE Published:
15 March 2020

Summary

FortiManager is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) due to insufficient verification of data authenticity. This flaw could enable an unauthenticated attacker to hijack WebSocket connections, potentially leading to unauthorized access or data manipulation. Ensure that you are using updated versions of FortiManager to mitigate this security risk.

Affected Version(s)

Fortinet FortiManager 6.2.1

Fortinet FortiManager 6.2.0

Fortinet FortiManager 6.0.6 and below

References

https://fortiguard.com/psirt/FG-IR-19-191
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.