CVE-2017-14185

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal.

Score

CVSS 3.0 5.3 Medium

Status

Modified - psirt@fortinet.com

Published

2018-05-25

Last modified

2024-10-25

Weaknesses

CWE-200

Affected products

• Fortios (Fortinet)
• Fortios (Fortinet Inc.)

References

• http://www.securityfocus.com/bid/104288
• https://fortiguard.com/advisory/FG-IR-17-231