description: An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiSwitch
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.3, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.7, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.7, status: affected
}
{
vendor: Fortinet
product: FortiWeb
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.2, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.16, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.7, status: affected
versionType: semver, version: 6.1.0, lessThanOrEqual: 6.1.3, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.8, status: affected
}
{
vendor: Fortinet
product: FortiProxy
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.1, status: affected
versionType: semver, version: 2.0.0, lessThanOrEqual: 2.0.7, status: affected
versionType: semver, version: 1.2.0, lessThanOrEqual: 1.2.13, status: affected
versionType: semver, version: 1.1.0, lessThanOrEqual: 1.1.6, status: affected
versionType: semver, version: 1.0.0, lessThanOrEqual: 1.0.7, status: affected
}
{
vendor: Fortinet
product: FortiOS
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.3, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.8, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.12, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.16, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C
]
solutions: Upgrade to FortiOS version 7.0.7 or above.
Upgrade to FortiOS version 6.4.9 or above.
Upgrade to FortiWeb version 7.0.0 or above.
upgrade to FortiWeb version 6.3.17 or above.
Upgrade to FortiProxy version 7.0.7 or above.
Upgrade to FortiProxy version 2.0.8 or above.
Upgrade to FortiSwitch version 7.2.0 or above.
Upgrade to FortiSwitch version 7.0.4 or above.
Upgrade to FortiSwitch version 6.4.11 or above.