Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-g3r6-2cv3-63vw

Опубликовано: 12 авг. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 8.1

Описание

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6.4.0 through 6.4.15 and before 6.2.16, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and before 7.0.15 & FortiPAM before version 1.2.0 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6.4.0 through 6.4.15 and before 6.2.16, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and before 7.0.15 & FortiPAM before version 1.2.0 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

EPSS

Процентиль: 45%
0.00572
Низкий

8.1 High

CVSS3

Дефекты

CWE-288

Связанные уязвимости

CVSS3: 8.1
nvd
около 1 года назад

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

CVSS3: 8.1
fstec
около 1 года назад

Уязвимость операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, связанная с обходом процедуры аутентификации посредством использования альтернативного пути или канала, позволяющая нарушителю получить полный контроль над устройством

EPSS

Процентиль: 45%
0.00572
Низкий

8.1 High

CVSS3

Дефекты

CWE-288