CVE-2017-7337

—

CVSS 3.0

9.1 critical

EPSS

1%p63

Published

May 27, 2017 (May 27, 2017)

Modified

Jun 17, 2026

Description

An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.

Vendors: fortinet
Products: fortiportal
Weakness: CWE-732
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.