Fortiweb 5.1.x Cross Site Request Forgery Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | FortiWeb < 5.2.0 Multiple XSRF Vulnerabilities | 9 Apr 201500:00 | – | nessus |
| Fortinet FortiWeb < 5.2.0 Multiple XSRF Vulnerabilities | 20 May 201400:00 | – | nessus |
 | CVE-2014-3115 | 8 May 201414:00 | – | cve |
 | CVE-2014-3115 | 8 May 201414:00 | – | cvelist |
 | EUVD-2014-3136 | 7 Oct 202500:30 | – | euvd |
 | FortiWeb Cross-Site Request Forgery Vulnerability | 2 May 201400:00 | – | fortinet |
 | CVE-2014-3115 | 8 May 201414:29 | – | nvd |
 | Fortinet FortiWeb CSRF Vulnerability (FG-IR-14-013) | 11 Feb 201500:00 | – | openvas |
 | Cross site request forgery (csrf) | 8 May 201414:29 | – | prion |
 | Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability | 7 May 201400:00 | – | cert |
FortiWeb Cross-Site Request Forgery Vulnerability
Multiple CSRF vulnerabilities exist in the FortiWeb web administration console due to lack of CSRF token protection. This could allow remote attackers to perform administrative actions under specific conditions.
Impact
A remote unauthenticated attacker may be able to trick a user into making an unintentional request to the web administration interface, via link or JavaScript hosted on a malicious web page. This forged request may be treated as authentic and result in unauthorized actions in the web administration interface. A successful attack would require the administrator to be logged in, and attacker knowledge of the internal FortiWeb administration URL.
Affected Products
FortiWeb 5.1.x and lower.
Solutions
Upgrade to FortiWeb 5.2.0 or higher.
Acknowledgement
This vulnerability was separately reported by both William Costa and Enrique Nissim.
# 0day.today [2018-04-10] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 May 2014 00:00Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.01179