Lucene search

FortinetCVE-2018-1355

HistoryJun 27, 2018 - 8:29 p.m.

CVE-2018-1355

2018-06-2720:29:04

CWE-601

fortinet

web.nvd.nist.gov

fortimanager

fortianalyzer

open redirect

vulnerability

script code injection

pdf conversion

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

59.2%

JSON

An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature. An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.

Affected configurations

Nvd

Node

fortinetfortianalyzerRange≤5.6.5

fortinetfortianalyzerMatch6.0.0

fortinetfortimanagerRange≤5.6.5

fortinetfortimanagerMatch6.0.0

VendorProductVersionCPE
fortinetfortianalyzer*cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
fortinetfortianalyzer6.0.0cpe:2.3:a:fortinet:fortianalyzer:6.0.0:*:*:*:*:*:*:*
fortinetfortimanager*cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
fortinetfortimanager6.0.0cpe:2.3:a:fortinet:fortimanager:6.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortianalyzer	*	cpe:2.3:a:fortinet:fortianalyzer::::::::
fortinet	fortianalyzer	6.0.0	cpe:2.3:a:fortinet:fortianalyzer:6.0.0:::::::*
fortinet	fortimanager	*	cpe:2.3:a:fortinet:fortimanager::::::::
fortinet	fortimanager	6.0.0	cpe:2.3:a:fortinet:fortimanager:6.0.0:::::::*

CNA Affected

[
  {
    "product": "Fortinet FortiManager, FortiAnalyzer",
    "vendor": "Fortinet, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "FortiManager 6.0.0, 5.6.5 and below versions"
      },
      {
        "status": "affected",
        "version": "FortiAnalyzer 6.0.0, 5.6.5 and below versions"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104546

www.securitytracker.com/id/1041184

www.securitytracker.com/id/1041185

fortiguard.com/advisory/FG-IR-18-022

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

59.2%

JSON

Related for CVE-2018-1355