CVE-2019-17654: High severity fortinet fortimanager vulnerability
Published Mar 15, 2020
·Updated
An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack.
Affected Software
3 affected components
Fortinet FortiManager<=6.0.6
Fortinet FortiManager=6.2.0
Fortinet FortiManager=6.2.1
Event History
Mar 15, 2020
CVE Published
via MITRE·10:20 PM
Data Sourced
via MITRE·10:20 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2019-17654?
CVE-2019-17654 is an Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below.
2
How does CVE-2019-17654 impact FortiManager?
CVE-2019-17654 may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack.
3
What is the severity of CVE-2019-17654?
CVE-2019-17654 has a severity rating of 8.8 (high).
4
Which versions of FortiManager are affected by CVE-2019-17654?
FortiManager versions 6.2.1, 6.2.0, 6.0.6, and below are affected by CVE-2019-17654.
5
How can I fix CVE-2019-17654?
To fix CVE-2019-17654, upgrade FortiManager to a version that is not affected by the vulnerability.