Details of VAR-201805-0117

ID

VAR-201805-0117

CVE

CVE-2017-14185

TITLE

Fortinet FortiOS Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2017-013473

DESCRIPTION

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal. Fortinet FortiOS Contains an information disclosure vulnerability.Information may be obtained. Fortinet FortiOS is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. The following versions are vulnerable: FortiOS 5.6.0 to 5.6.2 FortiOS 5.4.0 to 5.4.8 FortiOS 5.2 through 5.2.12

Trust: 1.98

sources: NVD: CVE-2017-14185 // JVNDB: JVNDB-2017-013473 // BID: 104288 // VULHUB: VHN-104882

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortios	scope:	lte	version:	5.6.2	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	5.6.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lte	version:	5.2.13	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	lte	version:	5.4.8	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	5.4.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	gte	version:	5.2.0	Trust: 1.0
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.3	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.8	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.6	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.5	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.4	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.3	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.2	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.0	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.9	Trust: 0.9
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.x	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.0 to 5.4.8	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6.0 to 5.6.2	Trust: 0.8
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.7	Trust: 0.6
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6.2	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.8	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.7	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.6	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.5	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.4	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.2	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.4.1	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.12	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.1	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.6.1	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2.10	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	eq	version:	5.2	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	5.6.3	Trust: 0.3
vendor:	fortinet	model:	fortios	scope:	ne	version:	5.4.9	Trust: 0.3

sources: BID: 104288 // JVNDB: JVNDB-2017-013473 // CNNVD: CNNVD-201709-358 // NVD: CVE-2017-14185

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-14185
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-14185
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201709-358
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-104882
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-14185
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-104882
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-14185
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-104882 // JVNDB: JVNDB-2017-013473 // CNNVD: CNNVD-201709-358 // NVD: CVE-2017-14185

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.9

sources: VULHUB: VHN-104882 // JVNDB: JVNDB-2017-013473 // NVD: CVE-2017-14185

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-358

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201709-358

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-013473

PATCH

title:

FG-IR-17-231

url:

https://fortiguard.com/psirt/FG-IR-17-231

Trust: 0.8

sources: JVNDB: JVNDB-2017-013473

EXTERNAL IDS

db:	NVD	id:	CVE-2017-14185	Trust: 2.8
db:	BID	id:	104288	Trust: 1.4
db:	JVNDB	id:	JVNDB-2017-013473	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-358	Trust: 0.7
db:	VULHUB	id:	VHN-104882	Trust: 0.1

sources: VULHUB: VHN-104882 // BID: 104288 // JVNDB: JVNDB-2017-013473 // CNNVD: CNNVD-201709-358 // NVD: CVE-2017-14185

REFERENCES

url:	https://fortiguard.com/advisory/fg-ir-17-231	Trust: 1.7
url:	http://www.securityfocus.com/bid/104288	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14185	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-14185	Trust: 0.8
url:	http://www.fortinet.com/	Trust: 0.3
url:	https://fortiguard.com/psirt/fg-ir-17-231	Trust: 0.3

sources: VULHUB: VHN-104882 // BID: 104288 // JVNDB: JVNDB-2017-013473 // CNNVD: CNNVD-201709-358 // NVD: CVE-2017-14185

CREDITS

Fox-IT

Trust: 0.3

sources: BID: 104288

SOURCES

db:	VULHUB	id:	VHN-104882
db:	BID	id:	104288
db:	JVNDB	id:	JVNDB-2017-013473
db:	CNNVD	id:	CNNVD-201709-358
db:	NVD	id:	CVE-2017-14185

LAST UPDATE DATE

2024-08-14T14:33:07.694000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-104882	date:	2018-06-27T00:00:00
db:	BID	id:	104288	date:	2018-05-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-013473	date:	2018-07-13T00:00:00
db:	CNNVD	id:	CNNVD-201709-358	date:	2017-09-12T00:00:00
db:	NVD	id:	CVE-2017-14185	date:	2018-06-27T11:12:55.200

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-104882	date:	2018-05-25T00:00:00
db:	BID	id:	104288	date:	2018-05-18T00:00:00
db:	JVNDB	id:	JVNDB-2017-013473	date:	2018-07-13T00:00:00
db:	CNNVD	id:	CNNVD-201709-358	date:	2017-09-12T00:00:00
db:	NVD	id:	CVE-2017-14185	date:	2018-05-25T16:29:00.230