CVE-2020-12812: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
Other sources
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
— CISA
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-12812?
CVE-2020-12812 is classified as a high severity vulnerability.
How do I fix CVE-2020-12812?
To fix CVE-2020-12812, upgrade FortiOS to version 6.0.10 or higher, or to versions 6.2.4 or later.
What software versions are affected by CVE-2020-12812?
CVE-2020-12812 affects FortiOS versions 6.0.9 and below, 6.2.0 to 6.2.3, and 6.4.0.
What type of vulnerability is CVE-2020-12812?
CVE-2020-12812 is an improper authentication vulnerability in SSL VPN.
Can users bypass the second factor of authentication due to CVE-2020-12812?
Yes, users may bypass the second factor of authentication by changing the case of their username.