| |
Vulnerability CVE-2018-9195
Published: 2019-11-21 Modified: 2019-11-24
Description: |
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below. |
See advisories in our WLB2 database: | Topic | Author | Date |
Med. |
| Stefan Viehbock | 27.11.2019 |
Type:
CWE-798
CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
4.3/10 |
2.9/10 |
8.6/10 |
Exploit range |
Attack complexity |
Authentication |
Remote |
Medium |
No required |
Confidentiality impact |
Integrity impact |
Availability impact |
Partial |
None |
None |
References: |
https://fortiguard.com/advisory/FG-IR-18-100
|
|
|
closedb();
?>
Copyright 2024, cxsecurity.com
|
|
|