CVE-2017-3126 - An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0

CVE-2017-3126

Summary

An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.

References

Vulnerable Configurations

cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortimanager_firmware:5.4.2:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 08-07-2017 - 01:29)
Impact:
Exploitability:

CWE

CWE-601

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	98557
confirm	https://fortiguard.com/psirt/FG-IR-17-014
sectrack	1038539 1038540

Last major update

08-07-2017 - 01:29

Published

27-05-2017 - 00:29

Last modified

08-07-2017 - 01:29