CVE-2017-14184

An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to...

CVE-2017-7344

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain...

Privilege escalation

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain...

CVE-2017-7344

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain...

CVE-2017-7344

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain...

CVE-2017-7344

CVE-2017-7344 describes a privilege escalation in Fortinet FortiClient Windows versions 5.4.3 and earlier and 5.6.0. An attacker can exploit the Windows “security alert” dialog when VPN before logon is enabled and an untrusted certificate chain to gain SYSTEM-level privileges. Exploitation can be...

CVE-2017-7344

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain...

Fortinet FortiClient VPN Credential Disclosure Vulnerability

FortiClient stores the VPN authentication credentials in a configuration file on Linux or Mac OSX or in registry on Windows. The credentials are encrypted but can still be recovered since the decryption key is hardcoded in the program and the same on all installations. Above all, the aforemention...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

Information disclosure

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

Fortinet FortiOS has an information disclosure vulnerability (CVE-2017-7738) affecting FortiOS 5.6.0–5.6.2, 5.4.0–5.4.5, and 5.2 and earlier. An admin with super_admin privileges can view the SSL VPN web portal session info via the fnsysctl CLI, potentially exposing user credentials. Related advi...

Fortinet FortiClient VPN Credential Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: VPN credentials disclosure product: Fortinet FortiClient vulnerable version: 4.4.2335 on Linux, 5.6.1 on Windows, 5.6.1 on Mac OSX fixed version: 4.4.2335 on Linux, 5.6.1...

FortiGate SSL VPN Portal 5.x Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: FortiGate SSL VPN Portal XSS Vulnerability product: Fortinet FortiOS vulnerable version: see: Vulnerable / tested versions fixed version: see: Solution CVE number:...

FortiGate SSL VPN Portal 5.x Cross Site Scripting Vulnerability

FortiGate SSL VPN Portal versions 5.6.2 and below, 5.4.6 and below, 5.2.12 and below, and 5.0 and below suffer from a cross site scripting vulnerability. ======================================================================= title: FortiGate SSL VPN Portal XSS Vulnerability product: Fortinet...

Fortinet FortiOS <= 5.4 / 5.6.x < 5.6.8 / 6.0.x < 6.0.5 SSL VPN Web Portal login redir XSS (FG-IR-17-242)

The version of Fortinet FortiOS running on the remote host is prior or equal to 5.4, 5.6.x prior to 5.6.8, or 6.0.x prior to 6.0.5. It is, therefore, affected by a cross-site scripting XSS vulnerability in the SSL VPN web portal due to a failure to sanitize the login redir parameter. An...

Fortinet FortiOS SSL-VPN Portal Cross-Site Scripting Vulnerability

Fortinet FortiOS is a set of security operating system developed by American Fita Fortinet dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. ssl-vpn portal is one of...

Fortinet FortiWebManager Security Feature Bypass Vulnerability

Fortinet FortiWebManager is a web application firewall. A security feature bypass vulnerability exists in Fortinet FortiWebManager, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...