Vulnerability Description
An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortiweb | >= 5.6.0, < 6.1.0 |
References
- http://www.securityfocus.com/bid/103430MitigationThird Party AdvisoryVDB Entry
- https://fortiguard.com/advisory/FG-IR-17-279Vendor Advisory
- http://www.securityfocus.com/bid/103430MitigationThird Party AdvisoryVDB Entry
- https://fortiguard.com/advisory/FG-IR-17-279Vendor Advisory
FAQ
What is CVE-2017-14191?
CVE-2017-14191 is a vulnerability with a CVSS score of 5.9 (MEDIUM). An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing ...
How severe is CVE-2017-14191?
CVE-2017-14191 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-14191?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortiweb.