SB2020031627 - Open redirect in Fortinet, FortiOS
Published: March 16, 2020 Updated: August 8, 2020
Security Bulletin ID
SB2020031627
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Open redirect (CVE-ID: CVE-2019-6696)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage.
Remediation
Install update from vendor's website.