Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
BID:63663
Info
Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
| Bugtraq ID: | 63663 |
| Class: | Design Error |
| CVE: |
CVE-2013-6826 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2013 12:00AM |
| Updated: | Nov 27 2013 12:25AM |
| Credit: | William Costa |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
FortiAnalyzer is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions in the context of the device running the affected application. Other attacks are also possible.
Versions prior to Fortianalyzer 4.3.7 and 5.0.5 are vulnerable.
FortiAnalyzer is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions in the context of the device running the affected application. Other attacks are also possible.
Versions prior to Fortianalyzer 4.3.7 and 5.0.5 are vulnerable.
Exploit / POC
Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
To exploit this issue an attacker must entice a user into visiting a malicious site.
The following example input is available:
To exploit this issue an attacker must entice a user into visiting a malicious site.
The following example input is available:
Solution / Fix
Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Fortinet FortiAnalyzer Cross Site Request Forgery Vulnerability
References:
References: