Overview
- Description
- An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
- Source
- psirt@fortinet.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:P/A:N
Known exploits
Data from CISA
- Vulnerability name
- Fortinet FortiOS and FortiProxy Improper Authorization
- Exploit added on
- Jan 10, 2022
- Exploit action due
- Jul 10, 2022
- Required action
- Apply updates per vendor instructions.
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B47708E-8A92-4767-8685-49C3143D0920",
"versionEndExcluding": "1.2.9"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3DD97EA-92AD-4EB1-B731-261F40BFC4BB"
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "250C33C2-29AD-4B75-BF05-E7256B4A5B54",
"versionEndExcluding": "5.4.11",
"versionStartIncluding": "5.4.1"
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A60D8EF-E47F-45A9-8E40-0169609D9B7B",
"versionEndExcluding": "5.6.9",
"versionStartIncluding": "5.6.0"
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D37F1481-E7A7-4428-89C9-5DF9D206D056",
"versionEndExcluding": "6.0.5",
"versionStartIncluding": "6.0.0"
}
],
"operator": "OR"
}
]
}
]