description: A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session.
problem types: Improper access control
affected:
{
vendor: Fortinet
product: FortiWeb
defaultStatus: unaffected
versions:
versionType: semver, version: 6.4.0, lessThanOrEqual: 6.4.2, status: affected
versionType: semver, version: 6.3.0, lessThanOrEqual: 6.3.16, status: affected
versionType: semver, version: 6.2.0, lessThanOrEqual: 6.2.6, status: affected
versionType: semver, version: 6.1.0, lessThanOrEqual: 6.1.2, status: affected
versionType: semver, version: 6.0.0, lessThanOrEqual: 6.0.7, status: affected
versionType: semver, version: 5.9.0, lessThanOrEqual: 5.9.1, status: affected
versionType: semver, version: 5.8.5, lessThanOrEqual: 5.8.7, status: affected
versionType: semver, version: 5.8.0, lessThanOrEqual: 5.8.3, status: affected
versionType: semver, version: 5.7.0, lessThanOrEqual: 5.7.3, status: affected
versionType: semver, version: 5.6.0, lessThanOrEqual: 5.6.2, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C
]
solutions: Please upgrade to FortiWeb version 7.0.0 or above
Please upgrade to FortiWeb version 6.3.17 or above
Please upgrade to FortiWeb version 6.2.7 or above
Please upgrade to FortiWeb version 6.1.3 or above
Please upgrade to FortiWeb version 6.0.8 or above
Please upgrade to FortiWeb version 5.9.2 or above