CVE-2017-7738: Infoleak
Published Dec 13, 2017
·Updated
An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command.
Affected Software
3 affected components
Fortinet FortiOS<=5.2
Fortinet FortiOS>=5.4.0<=5.4.5
Fortinet FortiOS>=5.6.0<=5.6.2
Event History
Dec 13, 2017
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-7738?
CVE-2017-7738 is considered to be a medium severity vulnerability.
2
Who is affected by CVE-2017-7738?
CVE-2017-7738 affects users of Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below.
3
How do I fix CVE-2017-7738?
To fix CVE-2017-7738, upgrade Fortinet FortiOS to the latest version that addresses this vulnerability.
4
What type of vulnerability is CVE-2017-7738?
CVE-2017-7738 is classified as an Information Disclosure vulnerability.
5
Can a regular user exploit CVE-2017-7738?
No, only an admin user with super_admin privileges can exploit CVE-2017-7738.