An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Una vulnerabilidad de verificación impropia de firma criptográfica en Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 hasta 7.6.4, FortiWeb 7.4.0 hasta 7.4.9 puede permitir a un atacante no autenticado eludir la autenticación de inicio de sesión de FortiCloud SSO a través de un mensaje de respuesta SAML manipulado.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-347
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| fortinet | fortiweb | * | <built-in method update of dict object at 0x763ef4a54440> | Application |
| fortinet | fortiweb | * | <built-in method update of dict object at 0x763ef4a56e80> | Application |
| fortinet | fortiweb | 8.0.0 | <built-in method update of dict object at 0x763ef791c240> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:* |