Revision 1 as of 2019-12-17 14:30:52

Clear message

Contents

  1. General Disclosure
  2. POC
  3. Affected Systems
  4. Possible Mitigations
  5. Thanks
  6. References

General Disclosure

This is a path-traversal vulnerability in the FortiOS SSL VPN web portal that could potentially allow an unauthenticated attacker to download files through specially crafted HTTP resource requests. Fortinet advises customers to upgrade to FortiOS 5.4.13, 5.6.11, 6.0.6, 6.2.2.

POC

Proof of concept, if available. 

telnet 1.2.3.4 5678

Affected Systems

Here is a list of the operating systems we have tested which are vulnerable to this attack:

Possible Mitigations

A list of all the possible mitigations.

Thanks

Thanks from

References