FortiPortal FG-IR-17-114 Multiple Security Vulnerabilities

Bugtraq ID:	98484
Class:	Input Validation Error
CVE:	CVE-2017-7337 CVE-2017-7343 CVE-2017-7731 CVE-2017-7338 CVE-2017-7339 CVE-2017-7340 CVE-2017-7342
Remote:	Yes
Local:	No
Published:	May 15 2017 12:00AM
Updated:	May 15 2017 12:00AM
Credit:	David Tredger, Senior Security Consultant, Aura Information Security
Vulnerable:	Fortinet FortiPortal 4.0
Not Vulnerable:	Fortinet FortiPortal 4.0.1

FortiPortal FG-IR-17-114 Multiple Security Vulnerabilities

FortiPortal is prone to the following multiple security vulnerabilities.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, bypass security restriction and perform unauthorized actions, redirect users to an attacker-controlled site or obtain sensitive information.

Versions prior to FortiPortal 4.0.1 are vulnerable.

FortiPortal FG-IR-17-114 Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FortiPortal FG-IR-17-114 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FortiPortal FG-IR-17-114 Multiple Security Vulnerabilities

References:

• Fortinet Homepage (Fortinet)
  
• FortiPortal Multiple Vulnerabilities (Fortinet )