An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Una vulnerabilidad de verificación impropia de firma criptográfica en Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 hasta 7.6.4, FortiWeb 7.4.0 hasta 7.4.9 puede permitir a un atacante no autenticado eludir la autenticación de inicio de sesión de FortiCloud SSO a través de un mensaje de respuesta SAML manipulado.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-347
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| fortinet | fortiweb | * | <built-in method update of dict object at 0x7d1e64bc92c0> | Application |
| fortinet | fortiweb | * | <built-in method update of dict object at 0x7d1e6c96d140> | Application |
| fortinet | fortiweb | 8.0.0 | <built-in method update of dict object at 0x7d1e5feca9c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:* |