PSIRT Advisories

Monthly PSIRT Advisories

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.  

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

An improper neutralization of input vulnerability in FortiAnalyzer and FortiTester may allow a remote authenticated attack...

Sep 21, 2020 Risk IR Number: FG-IR-20-054 CVE-2020-12815
An information exposure vulnerability in FortiWeb CLI may allow an authenticated user to view sensitive information being ...

Sep 18, 2020 Risk IR Number: FG-IR-19-269 CVE-2019-16157
An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attack...

FortiManager 6.2.5, 6.2.3, 6.2.2, 6.2.1, 6.2.0 FortiAnalyzer 6.2.8, 6.2.7
Sep 18, 2020 Risk IR Number: FG-IR-20-005 CVE-2020-12811
An improper neutralization of input during web page generation in the SSL VPN portal of FortiOS may allow a remote authen...

Sep 16, 2020 Risk IR Number: FG-IR-19-223 CVE-2019-15706
On June 16, 2020, cybersecurity researchers from JSOF published a set of 19 vulnerabilities, dubbed Ripple20 that are impa...

Jul 30, 2020 Risk IR Number: FG-IR-20-104 CVE-2020-11896 to 2020-11914
An improper authentication vulnerability in SSL VPN in FortiOS may result in a user being able to log in successfully with...

FortiOS 6.4.0, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
Jul 13, 2020 Risk IR Number: FG-IR-19-283 CVE-2020-12812
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiOS, FortiManager and FortiAnal...

FortiAnalyzer 6.0, 6.2 FortiManager 6.0, 6.2 FortiOS 6.0, 6.2
Jun 30, 2020 Risk IR Number: FG-IR-19-007 CVE-2019-6693
An improper access control vulnerability in the admin SSH console of multiple products may allow an authenticated user to ...

FortiManager 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiWAN 4.5.8, 4.5.7, 4.5.6, 4.5.5, 4.5.4, 4.5.3, 4.5.2, 4.5.1, 4.5.0 FortiADCManager 5.3.0 FortiAnalyzer 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiADC 5.3.4, 5.2.5 FortiAP-C 5.4.2 FortiAP-W2 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0 FortiAP-U 6.0.1, 6.0.0, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.0 FortiDDoS 5.2.0 FortiExtender 4.2.0 FortiWLC 8.5.4, 8.5.3, 8.5.2, 8.5.1 FortiPortal 5.3.2, 5.2.4 FortiDDoS-CM 5.2.0
Jun 26, 2020 Risk IR Number: FG-IR-19-292 CVE-2004-1653
An OS command injection vulnerability in FortiManager and FortiAnalyzer may allow a privileged system administrator to run...

FortiAuthenticator 6.1.2, 6.1.1, 6.1.0 FortiManager 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiAnalyzer 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0
Jun 26, 2020 Risk IR Number: FG-IR-19-294 CVE-2019-9193
An insufficient control of network message volume (CWE-406) vulnerability in FortiAnalyzer may allow an unauthenticated re...

FortiAnalyzer 6.4.0, 6.2.3 FortiRecorder 6.0.1, 6.0.0, 2.7.7
Jun 22, 2020 Risk IR Number: FG-IR-20-036 CVE-2013-5211
An insufficient session expiration vulnerability in FortiDeceptor may allow an attacker to reuse the unexpired admin user ...

FortiDeceptor 3.0.2, 3.0.1, 3.0.0
Jun 21, 2020 Risk IR Number: FG-IR-20-006 CVE-2020-6644
An expression language injection vulnerability in FortiSIEM JBoss RichFaces library may allow a remote attacker to inject ...

FortiSIEM 5.2.8, 5.2.6
Jun 21, 2020 Risk IR Number: FG-IR-20-041 CVE-2015-0279
An improper neutralization of input vulnerability in FortiWLC may allow a remote authenticated attacker to perform a store...

FortiWLC 8.5.1
Jun 21, 2020 Risk IR Number: FG-IR-20-016 CVE-2020-9288
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated a...

FortiAnalyzer 6.2.3, 6.2.2
Jun 03, 2020 Risk IR Number: FG-IR-20-003 CVE-2020-6640
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated pri...

FortiSIEMWindowsAgent 3.1.2
Jun 03, 2020 Risk IR Number: FG-IR-20-021 CVE-2020-9292