Where
AND
AND
-Infinity
0
Severity
6.1
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the Host header points to an arbitrary webserver

1 / 2
Source: MITRE

Remedy

FortiOS Administrative Interface Upgrade to FortiOS version 7.0.6 and above, Upgrade to FortiOS version 7.2.1 and above. AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global     set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" SSLVPN interface Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings                  set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection. Webfilter interface (port 8008) Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above Upgrade to FortiOS version 7.0.12 or above Upgrade to FortiOS version 6.4.13 or above FortiProxy Administrative Interface Upgrade to FortiProxy version 7.0.5 and above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global     set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" SSLVPN interface Upgrade to FortiProxy version 7.4.0 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings                  set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection. WebFilter interface (port 8008) Upgrade to FortiProxy version 7.4.0 or above Upgrade to FortiRecorder version 7.0.0 or above Upgrade to FortiRecorder version 6.4.3 or above Upgrade to FortiRecorder version 6.0.11 or above Upgrade to FortiNDR version 7.4.0 or above FortiAnalyzer & FortiManager Upgrade to version 7.6.0 or above Upgrade to version 7.4.4 or above Set the `admin-host` property to the device hostname, which will disable `Host redirection` for administrative interface. config system global set admin-host end FortiNDR Upgrade to FortiNDR version 7.2.1 or above Upgrade to FortiNDR version 7.1.1 or above AND Set the `https-redirect-host` property to the device hostname, which will disable `Host redirection`: config system global     set https-redirect-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" end FortiADC Upgrade to FortiADC version 7.1.0 or above Upgrade to FortiADC version 7.0.2 or above Upgrade to FortiADC version 6.2.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`:   config system global     set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" FortiDDOS-F Upgrade to FortiDDoS-F version 6.4.0 or above Upgrade to FortiDDoS-F version 6.3.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`:   config system global     set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" Upgrade to FortiSwitch version 7.2.0 or above Upgrade to FortiSwitch version 7.0.5 or above Upgrade to FortiSwitch version 6.4.11 or above Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiMail version 7.2.0 or above Upgrade to FortiMail version 7.0.4 or above Upgrade to FortiWLC version 8.6.7 or above Upgrade to FortiAuthenticator version 6.4.2 or above Upgrade to FortiAuthenticator version 6.3.4 or above Upgrade to FortiDDoS version 5.6.0 or above Upgrade to FortiDDoS version 5.5.2 or above Upgrade to FortiSOAR version 7.3.0 or above Upgrade to FortiTester version 7.3.0 or above Upgrade to FortiTester version 7.2.2 or above
First published (updated )
Severity
6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C

A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.

Remedy

Please upgrade to FortiAuthenticator version 6.6.1 or above Please upgrade to FortiAuthenticator version 6.5.4 or above
First published (updated )
Severity
5.3
Infoleak
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

A fundamental design flaw within the RADIUS protocol has been proven to be exploitable, compromising the integrity in the RADIUS Access-Request process. The attack allows a malicious user to modify packets in a way that would be indistinguishable to a RADIUS client or server. To be successful, the attacker must have the ability to inject themselves between the client and server.

1 / 6
Source: FortiGuard

Remedy

Disable the use of RADIUS/UDP and RADIUS/TCP - instead RADIUS/TLS or RADIUS/DTLS should be used.

Remedy

TBD

Remedy

The best way to address this issue is by using encrypted and authenticated channels that offer modern cryptographic security guarantees. Configure an alternate authentication mechanism if you are using RADIUS with a CHAP or PAP authentication protocol. PAN-OS provides the following alternate RADIUS authentication mechanisms: PEAP-MSCHAPv2 (default), PEAP with GTC, and EAP-TTLS with PAP. For more information, please see https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication/configure-radius-authentication. In addition, instead of using RADIUS, you can configure an alternate authentication mechanism using one of the options described here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication. If you are a Prisma Access customer using a RADIUS configuration with PAP or CHAP in your profile and have not applied one of the changes described above, please reach out to TAC/CS to schedule an upgrade window. PAN-OS 9.1.19, PAN-OS 10.1.14, PAN-OS 10.2.10, PAN-OS 11.0.7, PAN-OS 11.1.3, and all later PAN-OS versions add a new feature to enforce an authentication check in RADIUS. This new feature is disabled by default to match the existing behavior. To enable this feature, run the following commands: > set auth radius-require-msg-authentic yes To confirm that the setting was correctly enabled, run the following command: > show auth radius-require-msg-authentic If set correctly, the response will say "yes". This setting is persistent across reboots. No ‘commit’ is required for this to take effect. Please note that this feature requires that the RADIUS server has been updated to support the new protocol changes, as detailed in https://kb.cert.org/vuls/id/456537. If your RADIUS authentication breaks when radius-require-msg-authentic is set to yes, please work with your RADIUS server vendor for support with the RADIUS server upgrade process.
First published (updated )
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

Remedy

Please upgrade to FortiAuthenticator version 6.5.0 or above Please upgrade to FortiAuthenticator version 6.4.7 or above Please upgrade to FortiAuthenticator version 6.4.5 or above Please upgrade to FortiAuthenticator version 6.3.4 or above
First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203