Description
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| FortiAnalyzer | Fortinet / FortiAnalyzer | >= 7.0.0, <= 7.0.15 | affected |
| FortiAnalyzer | Fortinet / FortiAnalyzer | >= 7.2.0, <= 7.2.11 | affected |
| FortiAnalyzer | Fortinet / FortiAnalyzer | >= 7.4.0, <= 7.4.9 | affected |
| FortiAnalyzer | Fortinet / FortiAnalyzer | >= 7.6.0, <= 7.6.5 | affected |
| FortiManager | Fortinet / FortiManager | >= 7.0.0, <= 7.0.15 | affected |
| FortiManager | Fortinet / FortiManager | >= 7.2.0, <= 7.2.11 | affected |
| FortiManager | Fortinet / FortiManager | >= 7.4.0, <= 7.4.9 | affected |
| FortiManager | Fortinet / FortiManager | >= 7.6.0, <= 7.6.5 | affected |
| FortiNAC-F | Fortinet / FortiNAC-F | >= 7.6.3, <= 7.6.5 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.0.0, <= 7.0.18 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.2.0, <= 7.2.12 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.4.0, <= 7.4.10 | affected |
| FortiOS | Fortinet / FortiOS | >= 7.6.0, <= 7.6.5 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.0.0, <= 7.0.22 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.2.0, <= 7.2.15 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.4.0, <= 7.4.12 | affected |
| FortiProxy | Fortinet / FortiProxy | >= 7.6.0, <= 7.6.4 | affected |
| FortiWeb | Fortinet / FortiWeb | >= 7.4.0, <= 7.4.11 | affected |
| FortiWeb | Fortinet / FortiWeb | >= 7.6.0, <= 7.6.6 | affected |
| FortiWeb | Fortinet / FortiWeb | >= 8.0.0, <= 8.0.3 | affected |
| RUGGEDCOM APE1808 | Siemens / RUGGEDCOM APE1808 | >= 0, < * | affected |