description: An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiAnalyzer
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.2, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.7, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.11, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.12, status: affected
}
{
vendor: Fortinet
product: FortiSandbox
defaultStatus: unaffected
versions:
versionType: semver, version: 4.0.0, lessThanOrEqual: 4.0.2, status: affected
versionType: semver, version: 3.2.0, lessThanOrEqual: 3.2.4, status: affected
versionType: semver, version: 3.1.0, lessThanOrEqual: 3.1.5, status: affected
versionType: semver, version: 3.0.0, lessThanOrEqual: 3.0.7, status: affected
}
{
vendor: Fortinet
product: FortiManager
defaultStatus: unaffected
versions:
versionType: semver, version: 7.0.0, lessThanOrEqual: 7.0.1, status: affected
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.6, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.11, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.12, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C
]
solutions: Please upgrade to FortiManager version 7.0.2 or above.
Please upgrade to FortiManager version 6.4.7 or above.
Please upgrade to FortiAnalyzer version 7.0.3 or above.
Please upgrade to FortiAnalyzer version 6.4.8 or above.
Please upgrade to FortiSandbox version 4.2.0 or above