description: An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources.
problem types: Execute unauthorized code or commands
affected:
{
vendor: Fortinet
product: FortiAnalyzer
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.1, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.5, status: affected
versionType: semver, version: 6.4.8, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.4.0, lessThan: 6.4.*, status: affected
}
{
vendor: Fortinet
product: FortiManager
defaultStatus: unaffected
versions:
versionType: semver, version: 7.2.0, lessThanOrEqual: 7.2.1, status: affected
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.5, status: affected
versionType: semver, version: 6.4.8, lessThanOrEqual: 6.4.10, status: affected
versionType: semver, version: 6.4.0, lessThan: 6.4.*, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
]
solutions: Please upgrade to FortiManager version 7.2.2 or above
Please upgrade to FortiManager version 7.0.6 or above
Please upgrade to FortiManager version 6.4.11 or above
Please upgrade to FortiAnalyzer version 7.2.2 or above
Please upgrade to FortiAnalyzer version 7.0.6 or above
Please upgrade to FortiAnalyzer version 6.4.11 or above