description: A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiDDoS-F
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.1, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.4, status: affected
}
{
vendor: Fortinet
product: FortiADC
defaultStatus: unaffected
versions:
versionType: semver, version: 7.1.0, lessThanOrEqual: 7.1.1, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X
]
solutions: Please upgrade to FortiDDoS-F version 6.5.0 or above
Please upgrade to FortiDDoS-F version 6.4.2 or above
Please upgrade to FortiADC version 7.2.0 or above
Please upgrade to FortiADC version 7.1.2 or above