Vulnerability fixed in FortiManager and FortiAnalyzer

A server-side request forgery SSRF vulnerability in FortiManager and FortiAnalyser GUI could allow a remote attacker to gain access to unauthorized files and services on the system via specially designed web requests. Fortinet has released updates to fix the vulnerability. More information can be...

Fortinet FortiManager 访问控制错误漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOMs to further simplify multi-device security deployment and...

PT-2021-3979

Name of the Vulnerable Software and Affected Versions FortiManager versions 6.2.7 and below, 6.4.5 and below FortiManager versions 6.2.x, 6.0.x, 5.6.x FortiAnalyzer versions 6.2.7 and below, 6.4.5 and below FortiAnalyzer versions 6.2.x, 6.0.x, 5.6.x FortiPortal versions 5.2.5 and below, 5.3.5 and...

FortiManager & FortiAnalyzer - HTTP response splitting vulnerability

An improper neutralization of CRLF sequences in HTTP headers 'HTTP Response Splitting' vulnerability In FortiManager and FortiAnalyzer GUI may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of...

FortiManager & FortiAnalyzer - Improper validation of dispatcher socket parameters

A server-side request forgery SSRF CWE-918 vulnerability in FortiManager and FortiAnalyser GUI may allow a remote and authenticated attacker to access unauthorized  files and services on the system via specifically crafted web requests...

FortiManager, FortiAnalyzer and FortiPortal - Multiple OS command injection vulnerabilities

Multiple OS command injection CWE-78 vulnerabilities in the command line interface of FortiManager, FortiAnalyzer, and FortiPortal may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters...

Fortinet FortiManager 和 Fortinet FortiAnalyzer 访问控制错误漏洞

Fortinet FortiManager is a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager and FortiAnalyzer have an access control error vulnerability that could be exploited by an attacker to retrieve the list ...

Fortinet FortiManager 和 Fortinet FortiAnalyzer 跨站脚本漏洞

Fortinet FortiManager is a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager and FortiAnalyzer have a cross-site scripting vulnerability that can be exploited by attackers to trick victims into...

Fortinet FortiManager和Fortinet FortiAnalyzer 环境问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. Fortinet FortiAnalyzer is a centralized network security reporting solution that allows for centralized management of any number of Fortinet devices and the ability to group devices into different...

Fortinet 多款产品操作系统命令注入漏洞

Fortinet FortiManager, a centralized network security management platform, is a centralized network security reporting solution, Fortinet FortiAnalyzer. FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for the FortiGate, FortiWiFi, and FortiAP product...

FortiManager- Improper access control in SD-WAN Orchestrator

An improper access control vulnerability in FortiManager may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL...

PT-2021-7569

Name of the Vulnerable Software and Affected Versions FortiManager versions 6.4.0 through 6.4.3 Description The issue is related to improper access control in FortiManager, which may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel by directly...

PT-2021-5687

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.0.0, 6.4.5 and below, 6.2.7 and below FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below Description The issue is related to improper neutralization of input during web page generation, which may allow a...

PT-2021-7462

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyser GUI versions 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below Description A server-side request forgery SSRF vulnerability may allow a remote and authenticated attacker to access...

Fortinet FortiManager 和 Fortinet FortiAnalyzer 代码问题漏洞

Fortinet FortiManager is a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. The product is primarily used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in...

FortiManager and FortiAnalyzer - Multiple reflected XSS

Multiple improper neutralization of input during web page generation CWE-79 in FortiManager and FortiAnalyzer user interface may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious payload in GET parameters...

FortiManager & FortiAnalyzer - Improper access control on the administrators account list

An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration...

CVE-2021-24022

A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the diagnose system geoip-city command with a large...

CVE-2021-24022

A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the diagnose system geoip-city command with a large...

Buffer overflow

A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the diagnose system geoip-city command with a large...