Security feature bypass

2023-10-1017:15:00

PRIOn knowledge base

www.prio-n.com

client-side

security bypass

fortinet fortimanager

fortianalyzer

cwe-602

vulnerability

remote attacker

low privileges

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.8%

JSON

A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.

CPENameOperatorVersion
fortianalyzerge6.2.0
fortianalyzerle6.2.12
fortianalyzereq7.4.0
fortianalyzerge7.2.0
fortianalyzerle7.2.3
fortianalyzerge7.0.0
fortianalyzerle7.0.9
fortianalyzerge6.4.0
fortianalyzerle6.4.13
fortimanagerge6.2.0

Name	Operator	Version
fortianalyzer	ge	6.2.0
fortianalyzer	le	6.2.12
fortianalyzer	eq	7.4.0
fortianalyzer	ge	7.2.0
fortianalyzer	le	7.2.3
fortianalyzer	ge	7.0.0
fortianalyzer	le	7.0.9
fortianalyzer	ge	6.4.0
fortianalyzer	le	6.4.13
fortimanager	ge	6.2.0