CVE-2013-1414: CSRF
First published: Mon Jul 08 2013(Updated: )
Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS IPS Engine | <=4.3.12 | |
| Fortinet FortiOS IPS Engine | =4.3.10 | |
| Fortinet FortiOS IPS Engine | =5.0 | |
| Fortinet FortiOS IPS Engine | =5.0.1 | |
| Fortinet Fortigate-1000c | ||
| Fortinet Fortigate-100d | ||
| Fortinet Fortigate-110c | ||
| Fortinet Fortigate-1240b | ||
| Fortinet Fortigate-200b | ||
| Fortinet Fortigate-20c | ||
| Fortinet Fortigate-300c | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate-310b | ||
| Fortinet Fortigate-311b | ||
| Fortinet Fortigate-3140b | ||
| Fortinet Fortigate-3240c | ||
| Fortinet Fortigate-3810a | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate-40c | ||
| Fortinet Fortigate-5001A | ||
| Fortinet Fortigate-5001b | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate-5101C | ||
| Fortinet Fortigate-5140b | ||
| Fortinet Fortigate | ||
| Fortinet Fortigate-60c | ||
| Fortinet Fortigate-620b | ||
| Fortinet Fortigate-800c | ||
| Fortinet Fortigate-voice-80c | ||
| Fortinet Fortigate-voice-80c | ||
| Fortinet FortiGate Rugged-100C |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-1414?
CVE-2013-1414 has a critical severity rating due to its ability to allow unauthorized changes to FortiGate firewall settings.
How do I fix CVE-2013-1414?
To fix CVE-2013-1414, upgrade Fortinet FortiOS to version 4.3.13 or later, or to any 5.x version higher than 5.0.2.
What are the potential impacts of CVE-2013-1414?
The potential impacts of CVE-2013-1414 include unauthorized access to administrative functions, allowing attackers to modify settings, policies, or restart the device.
Which devices are affected by CVE-2013-1414?
CVE-2013-1414 affects various Fortinet FortiGate firewall devices running FortiOS versions prior to 4.3.13 and 5.x versions before 5.0.2.
Can CVE-2013-1414 be exploited remotely?
Yes, CVE-2013-1414 can be exploited remotely, allowing attackers to hijack the authentication of administrators.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet fortios ips engine
- version/fortinet fortios ips engine/4.3.12
- version/fortinet fortios ips engine/4.3.10
- version/fortinet fortios ips engine/5.0
- version/fortinet fortios ips engine/5.0.1
- canonical/fortinet fortigate-1000c
- canonical/fortinet fortigate-100d
- canonical/fortinet fortigate-110c
- canonical/fortinet fortigate-1240b
- canonical/fortinet fortigate-200b
- canonical/fortinet fortigate-20c
- canonical/fortinet fortigate-300c
- canonical/fortinet fortigate
- canonical/fortinet fortigate-310b
- canonical/fortinet fortigate-311b
- canonical/fortinet fortigate-3140b
- canonical/fortinet fortigate-3240c
- canonical/fortinet fortigate-3810a
- canonical/fortinet fortigate-40c
- canonical/fortinet fortigate-5001a
- canonical/fortinet fortigate-5001b
- canonical/fortinet fortigate-5101c
- canonical/fortinet fortigate-5140b
- canonical/fortinet fortigate-60c
- canonical/fortinet fortigate-620b
- canonical/fortinet fortigate-800c
- canonical/fortinet fortigate-voice-80c
- canonical/fortinet fortigate rugged-100c