Overview
- Description
- An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.
- Source
- psirt@fortinet.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.5
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity
- MEDIUM
Weaknesses
- psirt@fortinet.com
- CWE-639
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44C143C2-D850-4768-94D0-55615D670A47",
"versionEndIncluding": "5.3.8",
"versionStartIncluding": "5.3.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EBA19A35-E732-4B07-BE90-4B93B914D857",
"versionEndIncluding": "6.0.14",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "281311DE-FCED-4AB9-8D54-EBD0C8FE53B4",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "7.0.0"
},
{
"criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF4332EA-0FED-44AB-A395-E3D62B365012",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "7.2.0"
}
],
"operator": "OR"
}
]
}
]