QID 375929

Date Published: 2021-10-29

QID 375929: Fortinet FortiManager VM Multiple Vulnerabilities (FG-IR-19-017)

FortiManager provides centralized policy-based provisioning, device configuration, and update management for for FortiGate, FortiWiFi, and FortiMail appliances, and FortiClient end-point security agents, plus end-to-end network monitoring and device control.

Affected Products:
FortiManager VM version 6.2.0, 6.0.6 and below

Fixed Products:
Upgrade to FortiManager VM versions 6.0.7 or 6.2.1

Detection Login(Authenticated)
QID will fire the command get system status and will match the affected version.
Note: we do not have support for FortiOS VM for now.

Lack of root file system integrity checking in Fortinet FortiManager VM application images may allow an attacker to implant third-party programs by recreating the image through specific methods.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

The customers are advised to refer to FG-IR-19-017 for more information.

Workaround:
Verify the integrity of VM images by comparing the SHA-512 checksum with the checksum indicated on downloads section for that image.

Vendor References

FG-IR-19-017 - www.fortiguard.com/psirt/FG-IR-19-017

CVEs related to QID 375929

CVE-2019-6695 |

Software Advisories

Advisory ID	Software	Component	Link
FG-IR-19-017			www.fortiguard.com/psirt/FG-IR-19-017

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].