FortiAnalyzer and FortiManager CVE-2017-3126 Open Redirect Vulnerability

Bugtraq ID:	98557
Class:	Input Validation Error
CVE:	CVE-2017-3126
Remote:	Yes
Local:	No
Published:	Feb 09 2017 12:00AM
Updated:	Feb 09 2017 12:00AM
Credit:	Ronan Dunne of Biocompatibles UK Ltd
Vulnerable:	Fortinet FortiManager 0 Fortinet FortiAnalyzer 0
Not Vulnerable:

FortiAnalyzer and FortiManager CVE-2017-3126 Open Redirect Vulnerability

FortiAnalyzer and FortiManager are prone to an open-redirect vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

FortiAnalyzer and FortiManager CVE-2017-3126 Open Redirect Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

FortiAnalyzer and FortiManager CVE-2017-3126 Open Redirect Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

FortiAnalyzer and FortiManager CVE-2017-3126 Open Redirect Vulnerability

References:

• Fortinet Homepage (Fortinet)
  
• FortiAnalyzer, FortiManager Open Redirect Vulnerability (Fortinet)