CVE-2014-3115 — Cross-Site Request Forgery in Fortinet Fortiweb

CWE-352 — Cross-Site Request Forgery10 documents6 sources
Severity
6.8MEDIUMNVD
EPSS
0.2%
top 55.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedMay 8
Latest updateMay 17

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDfortinet/fortiweb5.1.4+4

🔴Vulnerability Details

2
GHSA
GHSA-7qxv-9465-xvp7: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5↗2022-05-17
▶
CVEList
CVE-2014-3115: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet FortiWeb before 5↗2014-05-08
▶

📋Vendor Advisories

5
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
Red Hat
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶

💬Community

2
HackerOne
CSRF possible when SOP Bypass/UXSS is available↗2015-12-30
▶
Bugzilla
flash-plugin: information disclosure issues fixed in APSB15-16↗2015-07-08
▶
CVE-2014-3115 — Cross-Site Request Forgery in Fortinet | cvebase