CVE-2013-6826
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
- Score
- CVSS 2.0 6.8 Medium
- Status
- Modified - cve@mitre.org
- Published
- 2013-11-20
- Last modified
- 2024-09-16
- Weaknesses
- CWE-352
Affected products
- Fortianalyzer-1000d (Fortinet)
- Fortianalyzer-2000b (Fortinet)
- Fortianalyzer-200d (Fortinet)
- Fortianalyzer-3000d (Fortinet)
- Fortianalyzer-300d (Fortinet)
- Fortianalyzer-4000b (Fortinet)
- Fortianalyzer Firmware (Fortinet)
References
- http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt
- http://www.securityfocus.com/bid/63663
