description: A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiPresence
defaultStatus: unaffected
versions:
versionType: semver, version: 1.2.0, lessThanOrEqual: 1.2.1, status: affected
versionType: semver, version: 1.1.0, lessThanOrEqual: 1.1.1, status: affected
version: 1.0.0, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:X/RC:C
]
solutions: Please upgrade to FortiPresence version 2.0.0 or above