Sign-up

ID

VAR-202103-0173


CVE

CVE-2020-15938


TITLE

FortiGate  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-016236

DESCRIPTION

When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header. FortiGate Contains an unspecified vulnerability.Information may be tampered with. Opera Software Opera is a web browser produced by Opera Software in Norway. It supports multi-window browsing, custom user interface and other functions. HTTPS (Hypertext Transfer Protocol Secure) is a network security transmission protocol, which communicates via Hypertext Transfer Protocol (HTTP) on a computer network, and uses SSL/TLS to encrypt data packets. The main purpose of HTTPS development is to provide identity authentication to web servers and protect the privacy and integrity of exchanged data. Vulnerabilities exist in Opera Software Opera and HTTPS. The following products and versions are affected:

Trust: 1.71

sources: NVD: CVE-2020-15938 // JVNDB: JVNDB-2020-016236 // VULHUB: VHN-168966

AFFECTED PRODUCTS

vendor:fortinetmodel:fortiosscope:gteversion:6.4.0

Trust: 1.0

vendor:fortinetmodel:fortiosscope:lteversion:6.2.5

Trust: 1.0

vendor:fortinetmodel:fortiosscope:lteversion:6.4.2

Trust: 1.0

vendor:フォーティネットmodel:fortiosscope:eqversion: -

Trust: 0.8

vendor:フォーティネットmodel:fortiosscope:eqversion:6.4.2

Trust: 0.8

vendor:フォーティネットmodel:fortiosscope:eqversion:6.2.5

Trust: 0.8

sources: JVNDB: JVNDB-2020-016236 // NVD: CVE-2020-15938

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-15938
value: HIGH

Trust: 1.0

psirt@fortinet.com: CVE-2020-15938
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-15938
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202103-325
value: HIGH

Trust: 0.6

VULHUB: VHN-168966
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-15938
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-168966
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-15938
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

psirt@fortinet.com: CVE-2020-15938
baseSeverity: MEDIUM
baseScore: 4.0
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2020-15938
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-168966 // JVNDB: JVNDB-2020-016236 // CNNVD: CNNVD-202103-325 // NVD: CVE-2020-15938 // NVD: CVE-2020-15938

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-016236 // NVD: CVE-2020-15938

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-325

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-325

PATCH

title:FG-IR-20-172url:https://fortiguard.com/advisory/FG-IR-20-172

Trust: 0.8

title:Fortinet FortiGate Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=143735

Trust: 0.6

sources: JVNDB: JVNDB-2020-016236 // CNNVD: CNNVD-202103-325

EXTERNAL IDS

db:NVDid:CVE-2020-15938

Trust: 2.5

db:JVNDBid:JVNDB-2020-016236

Trust: 0.8

db:CNNVDid:CNNVD-202103-325

Trust: 0.7

db:AUSCERTid:ESB-2021.0774

Trust: 0.6

db:VULHUBid:VHN-168966

Trust: 0.1

sources: VULHUB: VHN-168966 // JVNDB: JVNDB-2020-016236 // CNNVD: CNNVD-202103-325 // NVD: CVE-2020-15938

REFERENCES

url:https://fortiguard.com/advisory/fg-ir-20-172

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-15938

Trust: 0.8

url:https://vigilance.fr/vulnerability/fortigate-data-transit-via-transparent-proxy-malformed-http-s-traffic-34766

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.0774

Trust: 0.6

sources: VULHUB: VHN-168966 // JVNDB: JVNDB-2020-016236 // CNNVD: CNNVD-202103-325 // NVD: CVE-2020-15938

SOURCES

db:VULHUBid:VHN-168966
db:JVNDBid:JVNDB-2020-016236
db:CNNVDid:CNNVD-202103-325
db:NVDid:CVE-2020-15938

LAST UPDATE DATE

2024-08-14T15:11:59.090000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-168966date:2021-03-11T00:00:00
db:JVNDBid:JVNDB-2020-016236date:2021-11-17T04:55:00
db:CNNVDid:CNNVD-202103-325date:2021-03-15T00:00:00
db:NVDid:CVE-2020-15938date:2021-03-11T13:56:58.360

SOURCES RELEASE DATE

db:VULHUBid:VHN-168966date:2021-03-04T00:00:00
db:JVNDBid:JVNDB-2020-016236date:2021-11-17T00:00:00
db:CNNVDid:CNNVD-202103-325date:2021-03-04T00:00:00
db:NVDid:CVE-2020-15938date:2021-03-04T18:15:12.863