CVE-2018-9185 — Sensitive Information Exposure in Fortinet Fortios

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.9%
top 23.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiosFortinet Fortios
Timeline
PublishedJul 5
Latest updateMay 14

Description

An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to client-side when pages bookmarked in web portal use the Single Sign-On feature.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortios6.0.0
▶CVEListV5fortinet/fortinet_fortiosFortiOS 6.0.0 and below

🔴Vulnerability Details

2
GHSA
GHSA-429g-2fpp-h4v3: An information disclosure vulnerability in Fortinet FortiOS 6↗2022-05-14
▶
CVEList
CVE-2018-9185: An information disclosure vulnerability in Fortinet FortiOS 6↗2018-07-05
▶

📋Vendor Advisories

1
Fortinet
An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login cre...↗2018-07-05
▶
CVE-2018-9185 — Sensitive Information Exposure | cvebase