CVE-2018-1354

An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the avatar picture of other users with arbitrary content.

Score

CVSS 3.0 6.5 Medium

Status

Modified - psirt@fortinet.com

Published

2018-06-27

Last modified

2024-10-25

Weaknesses

CWE-284, CWE-732

Affected products

• Fortianalyzer (Fortinet)
• Fortimanager (Fortinet)
• Fortianalyzer (Fortinet Inc.)
• Fortinet Fortimanager (Fortinet Inc.)

References

• http://www.securityfocus.com/bid/104537
• http://www.securitytracker.com/id/1041182
• http://www.securitytracker.com/id/1041183
• https://fortiguard.com/advisory/FG-IR-18-014