CVE-2015-3616: SQL Injection
Published Aug 11, 2017
·Updated
SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
Affected Software
19 affected components
Fortinet Fortimanager Firmware=5.0.0
Fortinet Fortimanager Firmware=5.0.1
Fortinet Fortimanager Firmware=5.0.2
Fortinet Fortimanager Firmware=5.0.3
Fortinet Fortimanager Firmware=5.0.4
Fortinet Fortimanager Firmware=5.0.5
Fortinet Fortimanager Firmware=5.0.6
Fortinet Fortimanager Firmware=5.0.7
Fortinet Fortimanager Firmware=5.0.8
Fortinet Fortimanager Firmware=5.0.9
Fortinet Fortimanager Firmware=5.0.10
Fortinet Fortimanager Firmware=5.2.0
Fortinet Fortimanager Firmware=5.2.1
Fortinet Fortimanager 2000e
Fortinet Fortimanager 200d
Fortinet Fortimanager 3000f
Fortinet Fortimanager 300e
Fortinet Fortimanager 3900e
Fortinet Fortimanager 400e
Event History
Aug 11, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3616?
CVE-2015-3616 is classified as a critical vulnerability allowing remote attackers to execute arbitrary commands.
2
How do I fix CVE-2015-3616?
To fix CVE-2015-3616, upgrade Fortinet FortiManager to version 5.0.11 or later, or 5.2.2 or later.
3
What versions of FortiManager are affected by CVE-2015-3616?
CVE-2015-3616 affects Fortinet FortiManager versions 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1.
4
Can CVE-2015-3616 be exploited without authentication?
Yes, CVE-2015-3616 can be exploited remotely, potentially without authentication.
5
What type of vulnerability is CVE-2015-3616?
CVE-2015-3616 is a SQL injection vulnerability that allows arbitrary command execution.