medium6.8Public exploit code
CVE-2013-6826
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows re…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fortinet FortiAnalyzer - Cross-Site Request Forgery2013-10-12 · remote · hardware · Verified
Impact
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortianalyzer Firmware | through 5.0.4 |
| Fortinet | Fortianalyzer-1000d | All versions |
| Fortinet | Fortianalyzer-2000b | All versions |
| Fortinet | Fortianalyzer-200d | All versions |
| Fortinet | Fortianalyzer-3000d | All versions |
| Fortinet | Fortianalyzer-300d | All versions |
| Fortinet | Fortianalyzer-4000b | All versions |