Lucene search

FortinetCVE-2018-1360

HistoryApr 25, 2019 - 6:29 p.m.

CVE-2018-1360

2019-04-2518:29:00

CWE-319

fortinet

web.nvd.nist.gov

cve-2018-1360

fortinet fortimanager

vulnerability

cleartext transmission

sensitive information

unauthenticated attacker

man in the middle

rest api

json responses

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.002

Percentile

52.2%

JSON

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses.

Affected configurations

Nvd

Node

fortinetfortimanagerRange5.2.0–5.2.7

fortinetfortimanagerMatch5.4.0

fortinetfortimanagerMatch5.4.1

VendorProductVersionCPE
fortinetfortimanager*cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
fortinetfortimanager5.4.0cpe:2.3:a:fortinet:fortimanager:5.4.0:*:*:*:*:*:*:*
fortinetfortimanager5.4.1cpe:2.3:a:fortinet:fortimanager:5.4.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortimanager	*	cpe:2.3:a:fortinet:fortimanager::::::::
fortinet	fortimanager	5.4.0	cpe:2.3:a:fortinet:fortimanager:5.4.0:::::::*
fortinet	fortimanager	5.4.1	cpe:2.3:a:fortinet:fortimanager:5.4.1:::::::*

CNA Affected

[
  {
    "product": "Fortinet FortiManager",
    "vendor": "Fortinet, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "5.2.0 to 5.2.7"
      },
      {
        "status": "affected",
        "version": "5.4.0"
      },
      {
        "status": "affected",
        "version": "5.4.1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108079

fortiguard.com/advisory/FG-IR-18-051

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.002

Percentile

52.2%

JSON

Related for CVE-2018-1360