Description
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| FortiOS | Fortinet / FortiOS | >= 6.4.0, <= 6.4.16 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.0.0, <= 7.0.19 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.2.0, <= 7.2.13 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.4.0, <= 7.4.6 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.6.0, <= 7.6.1 | affected |