CVSS: 4.9EPSS: 0%CPEs: 12EXPL: 0CVE-2016-7542
https://notcve.org/view.php?id=CVE-2016-7542
A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and 5.4.x before 5.4.2 GA may have access to read-write administrators password hashes (not including super-admins) stored on the appliance via the webui REST API, and may therefore be able to crack them. Un administrador de sólo lectura en dispositivos Fortinet con FortiOS 5.2.x en versiones anteriores a 5.2.10 GA y FortiOS 5.4.x en versiones anteriores a 5.4.2 GA puede tener acceso de lectura-escritura a hashes de contraseñas de administradores (no incluyendo super-admins), almacenados en el dispositivo a través de la API Rest webui, y puede por lo tanto ser capaz de romperlo. • http://fortiguard.com/advisory/FG-IR-16-050 http://www.securityfocus.com/bid/94690 http://www.securitytracker.com/id/1037394 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 17EXPL: 0CVE-2016-3978
https://notcve.org/view.php?id=CVE-2016-3978
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login." La Web User Interface (WebUI) en FortiOS 5.0.x en versiones anteriores a 5.0.13, 5.2.x en versiones anteriores a 5.2.3 y 5.4.x en versiones anteriores a 5.4.0 permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing o ataques de XSS a través del parámetro "redirect" en "login". • http://seclists.org/fulldisclosure/2016/Mar/68 http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability http://www.securitytracker.com/id/1035332 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 68%CPEs: 10EXPL: 4CVE-2016-1909 – Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Access
https://notcve.org/view.php?id=CVE-2016-1909
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session. Fortinet FortiAnalyzer en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.5; FortiSwitch 3.3.x en versiones anteriores a 3.3.3; FortiCache 3.0.x en versiones anteriores a 3.0.8; y FortiOS 4.1.x en versiones anteriores a 4.1.11, 4.2.x en versiones anteriores a 4.2.16, 4.3.x en versiones anteriores a 4.3.17 y 5.0.x en versiones anteriores a 5.0.8 tienen una frase de contraseña embebida para la cuenta Fortimanager_Access, lo que permite a atacantes remotos obtener acceso administrativo a través de una sesión SSH. • https://www.exploit-db.com/exploits/43386 http://blog.fortinet.com/post/brief-statement-regarding-issues-found-with-fortios http://packetstormsecurity.com/files/135225/FortiGate-OS-5.0.7-SSH-Backdoor.html http://seclists.org/fulldisclosure/2016/Jan/26 http://www.fortiguard.com/advisory/multiple-products-ssh-undocumented-login-vulnerability http://www.securitytracker.com/id/1034663 https://twitter.com/esizkur/status/686842135501508608 https://www.exploit-db.com/exploits/39224 https://seclists.org/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7361
https://notcve.org/view.php?id=CVE-2015-7361
FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors. FortiOS 5.2.3, cuando se configura para usar High Availability (HA) y la interfaz de administración dedicada está habilitada, no requiere autenticación para el acceso a la shell ZebOS en la interfaz de gestión dedicada HA, lo que permite a atacantes remotos obtener acceso a la shell a través de vectores no especificados. • http://fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.securitytracker.com/id/1033093 • CWE-287: Improper Authentication •
CVSS: 6.4EPSS: 0%CPEs: 16EXPL: 0CVE-2015-2323
https://notcve.org/view.php?id=CVE-2015-2323
FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets. Vulnerabilidad en FortiOS 5.0.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.4 admite el anonimato, exportación, RC4 y posiblemente otros cifrados débiles al utilizar TLS para conectarse a los servidores de FortiGuard, lo que permite a atacantes man-in-the-middle suplantar contenido TLS mediante la modificación de los paquetes. • http://fortiguard.com/advisory/2015-07-24-weak-ciphers-suites-are-presented-towards-fortiguard-servers http://www.fortiguard.com/advisory/FG-IR-15-021 http://www.securitytracker.com/id/1033092 • CWE-310: Cryptographic Issues •