Fortiweb 5.1.x Cross Site Request Forgery Vulnerability

FortiWeb versions 5.1.x and below suffer from a cross site request forgery vulnerability. FortiWeb Cross-Site Request Forgery Vulnerability Multiple CSRF vulnerabilities exist in the FortiWeb web administration console due to lack of CSRF token protection. This could allow remote attackers to...

PT-2014-5098

Name of the Vulnerable Software and Affected Versions FortiWeb versions prior to 5.2.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the web administration console. These vulnerabilities allow remote attackers to hijack the authentication of...

CVE-2014-3115: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability

Overview Fortinet Fortiweb prior to version 5.2.0 do not sufficiently verify whether a valid request was intentionally provided by the user, which results in a cross-site request forgery CSRF vulnerability. CWE-352 Description CWE-352: Cross-Site Request Forgery CSRF Fortinet Fortiweb prior to...

FortiWeb Cross-Site Request Forgery Vulnerability

...

CVE-2014-1956

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-1955

Cross-site scripting XSS vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1957

FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...

Design/Logic Flaw

FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...

Crlf injection

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1955

Cross-site scripting XSS vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1956

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-1957

FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...

CVE-2014-1955

FortiWeb (Fortinet) FortiWeb 4.x/5.x is affected by CVE-2014-1955, a cross-site scripting (XSS) vulnerability present in versions prior to 5.0.3. The issue allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors. The NVD entry lists a CVSS v2 base score of 4.3 (Med...

CVE-2014-1956

CVE-2014-1956 describes a CRLF injection in Fortinet FortiWeb prior to version 5.0.3, enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. The vulnerability is documented across multiple sources (NVD entry and FortiGuard FG-IR-13-...

CVE-2014-1957

Fortinet FortiWeb is affected by CVE-2014-1957 (FortiWeb prior to 5.0.3). The vulnerability allows remote authenticated users to gain privileges via unspecified vectors. Affected product: FortiWeb; vulnerable component/issue: privilege escalation in versions before 5.0.3. The issue is confirmed a...

PT-2014-4382

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description The issue allows remote authenticated users to gain privileges. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue...

PT-2014-4380

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve t...

PT-2014-4381

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or lat...