FortiManager and FortiAnalyzer flaws let admins escalate privileges
Original title: Incorrect authorization
An authenticated administrator can bypass authorization or impersonate internal services through crafted GUI requests.
Fortinet describes incorrect authorization, improper privilege management, and authentication bypass by spoofing in FortiManager, FortiManager Cloud, FortiAnalyzer, FortiAnalyzer Cloud, and FortiAnalyzer-BigData. An authenticated administrator may escalate privileges, bypass authorization controls, or impersonate internal services via crafted GUI requests. The score is CVSS 8.7, and the advisory was revised on November 10.
Unconfirmed: Affected versions, a fix, a CVE, and exploitation status are not stated.
- Cited weaknesses are CWE-863, CWE-269, and CWE-290.
- FortiAnalyzer-BigData is also listed as affected.
- The requests are sent to the product GUI.
- The CVSSv3 score is 8.7.
Impact: authenticated admin can escalate, bypass controls, or impersonate services
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
| Fortinet FortiManager Cloud | — |
| Fortinet FortiAnalyzer | — |
| Fortinet FortiAnalyzer Cloud | — |
| Fortinet FortiAnalyzer-BigData | — |
- Vendors
- Fortinet
From the original article
CVSSv3 Score: 8.
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.