Server side request forgery (ssrf)

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

CVE-2023-25609

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

CVE-2023-25609

Fortinet FortiManager and FortiAnalyzer GUI are affected by a server-side request forgery (SSRF) vulnerability (CWE-918) that may allow a remote, authenticated attacker to access unauthorized files and services via specially crafted web requests. Affected versions include FortiManager/ FortiAnaly...

CVE-2023-25609

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

Fortinet FortiManager 代码问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and the ability to group devices into different management domains ADOM to further simplify multi-device security deployment a...

CVE-2023-25609: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...

SSRF in FortiGuard Outbreak feature

...

CVE-2023-22642

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

CVE-2023-22642

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

Input validation

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

CVE-2023-22642

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

CVE-2023-22642

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

CVE-2023-22642

CVE-2023-22642 is an improper certificate validation vulnerability (CWE-295) in Fortinet FortiAnalyzer and FortiManager. Affects FortiAnalyzer/ FortiManager versions 6.4.8–6.4.10, 7.0.0–7.0.5, and 7.2.0–7.2.1, exposing remote, unauthenticated attackers to a Man-in-the-Middle on the link to the Fo...

Fortinet FortiManager 信任管理问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet appliances and the ability to group appliances into different administrative domains ADOMs to further simplify multi-appliance security...

PT-2023-7378 · Fortinet · Fortiguard +2

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer and FortiManager versions 6.4.8 through 6.4.10 FortiAnalyzer and FortiManager versions 7.0.0 through 7.0.5 FortiAnalyzer and FortiManager versions 7.2.0 through 7.2.1 Description: The issue is related to an improper certificate...

Lack of client-side certificate validation when establishing secure connections with FortiGuard to download outbreakalert

...

PT-2023-9682

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.6 FortiAnalyzer version 6.4 Description The issue is related to improper input validation, which may allow an authenticated attacker to disclose file...

CVE-2023-22642: Improper Certificate Validation

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the...

The vulnerabilities of the Fortinet FortiManager software, the FortiAnalyzer network firewall, the FortiSwitch network switches with embedded software, and the Fortinet FortiPortal security analysis and management tool allow attackers to disclose sensitive information.

The vulnerabilities of the Fortinet FortiManager device management software, FortiAnalyzer network monitoring software, FortiSwitch network switch software, and Fortinet FortiPortal security analysis and management tool are related to the lack of protection for sensitive data. Exploiting these...

Chinese Hackers Exploit Fortinet Zero-Day Flaw for Cyber Espionage Attack

The zero-day exploitation of a now-patched medium-severity security flaw in the Fortinet FortiOS operating system has been linked to a suspected Chinese hacking group. American cybersecurity company Mandiant, which made the attribution, said the activity cluster is part of a broader campaign...