FortiOS Path Traversal Credential Gatherer

frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FortiOS Path Traversal Credential Gatherer', 'Description' = %q Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6...

The vulnerabilities of the FortiOS graphical interface, the FortiProxy proxy server for protecting against internet attacks, and the FortiSwitchManager local management platform allow a perpetrator to gain unauthorized access to the device.

The vulnerability of the FortiOS graphical interface, the FortiProxy proxy server for protecting against internet attacks, and the FortiSwitchManager local management platform are related to incorrect session duration settings. Exploiting this vulnerability can allow a remote attacker to gain...

Fortinet FortiOS Access Control Error Vulnerability (CNVD-2024-37339)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An access control error...

The vulnerability in the web interface of SSL-VPN operating systems FortiOS and proxy servers for protecting against Internet attacks by FortiProxy allows attackers to perform cross-site scripting attacks.

The vulnerability of the SSL-VPN web interface for FortiOS operating systems and FortiProxy proxy servers exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site attacks, provided that the use...

The vulnerability of the IP address checking function in FortiOS operating systems and FortiProxy proxy servers allows attackers to circumvent existing security restrictions.

The vulnerability of the IP address checking function in FortiOS operating systems and FortiProxy proxy servers for protecting against Internet attacks is related to the improper handling of numerical parameters based on different criteria. Exploiting this vulnerability allows a malicious actor t...

CVE-2024-36505

An improper access control vulnerability CWE-284 in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system via another hypothetical exploit to bypass the file integrity...

CVE-2024-36505

An improper access control vulnerability CWE-284 in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system via another hypothetical exploit to bypass the file integrity...

CVE-2022-45862

An insufficient session expiration vulnerability CWE-613 vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below...

CVE-2022-45862

An insufficient session expiration vulnerability CWE-613 vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below...

CVE-2022-45862

An insufficient session expiration vulnerability CWE-613 vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below...

CVE-2022-45862

An insufficient session expiration vulnerability CWE-613 vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; FortiProxy 7.2 all versions, 7.0 all versions; FortiPAM 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; FortiSwitchManager 7.2.1 and below...

CVE-2022-45862

CVE-2022-45862 describes an insufficient session expiration flaw in Fortinet products (FortiOS, FortiProxy, FortiPAM, FortiSwitchManager) that may allow an attacker to reuse a GUI web session after logout if the attacker has the required credentials. Affected versions include FortiOS 7.2.5 and ea...

CVE-2024-36505

An improper access control vulnerability CWE-284 in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system via another hypothetical exploit to bypass the file integrity...

CVE-2024-36505

FortiOS contains an improper access control vulnerability (CWE-284) that could allow an attacker who already has write access to bypass the real-time file integrity checking system. Affected versions: FortiOS 7.4.0–7.4.3, 7.2.5–7.2.7, 7.0.12–7.0.14, and all 6.4.x. Root cause: bypass of file integ...

CVE-2024-36505

An improper access control vulnerability CWE-284 in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system via another hypothetical exploit to bypass the file integrity...

Fortinet FortiOS 访问控制错误漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An access control error...

Fortinet Fortigate GUI Console WebSockets do not terminate on logout (FG-IR-22-445)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-445 advisory. - An insufficient session expiration vulnerability CWE-613 vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 al...

PT-2024-5820 · Fortinet · Fortiproxy +3

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.5 and below, 7.0 all versions, 6.4 all versions FortiProxy versions 7.2 all versions, 7.0 all versions FortiPAM versions 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions FortiSwitchManager versions...

Fortinet Fortigate Real-time file system integrity checking write protection bypass (FG-IR-24-012)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-012 advisory. - An improper access control vulnerability CWE-284 in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14...

Fortinet FortiOS Cross-Site Scripting Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform of the United States Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A cross-site scripting...