description: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.
problem types: Execute unauthorized code or commands
affected:
{
vendor: Fortinet
product: FortiVoice
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.7, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.11, status: affected
}
{
vendor: Fortinet
product: FortiRecorder
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.2, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.11, status: affected
versionType: semver, version: 2.7.0, lessThanOrEqual: 2.7.7, status: affected
versionType: semver, version: 2.6.0, lessThanOrEqual: 2.6.3, status: affected
}
{
vendor: Fortinet
product: FortiSwitch
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.4, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.8, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.7, status: affected
}
{
vendor: Fortinet
product: FortiNDR
defaultStatus: unaffected
versions:
version: 7.1.0, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.4, status: affected
versionType: semver, version: 1.5.0, lessThanOrEqual: 1.5.3, status: affected
version: 1.4.0, status: affected
versionType: semver, version: 1.3.0, lessThanOrEqual: 1.3.1, status: affected
version: 1.2.0, status: affected
version: 1.1.0, status: affected
}
{
vendor: Fortinet
product: FortiMail
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.3, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.6, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.9, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.12, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:C
]
solutions: Please upgrade to FortiVoice version 7.0.0 or above
Please upgrade to FortiVoice version 6.4.8 or above
Please upgrade to FortiVoice version 6.0.12 or above
Please upgrade to FortiRecorder version 7.0.0 or above
Please upgrade to FortiRecorder version 6.4.3 or above
Please upgrade to FortiRecorder version 6.0.12 or above
Please upgrade to FortiSwitch version 7.2.0 or above
Please upgrade to FortiSwitch version 7.0.5 or above
Please upgrade to FortiSwitch version 6.4.11 or above
Please upgrade to FortiNDR version 7.2.0 or above
Please upgrade to FortiNDR version 7.1.1 or above
Please upgrade to FortiNDR version 7.0.5 or above
Please upgrade to FortiMail version 7.2.0 or above
Please upgrade to FortiMail version 7.0.4 or above
Please upgrade to FortiMail version 6.4.7 or above