Unscored severity · published Nov 20, 2013
CVE-2013-6826
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to…
–
CVSS
1.9%
EPSS
No
On KEV
Description
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fortianalyzer Firmware · Fortinet
through 5.0.4 · source: NVD
FO
Fortianalyzer-1000d · Fortinet
All versions, or not specified · source: NVD
FO
Fortianalyzer-2000b · Fortinet
All versions, or not specified · source: NVD
FO
Fortianalyzer-200d · Fortinet
All versions, or not specified · source: NVD
FO
Fortianalyzer-3000d · Fortinet
All versions, or not specified · source: NVD
FO
Fortianalyzer-300d · Fortinet
All versions, or not specified · source: NVD
FO
Fortianalyzer-4000b · Fortinet
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6826
Exploit
http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt
Exploit
http://www.securityfocus.com/bid/63663
More from Fortianalyzer Firmware
6.1
CVE-2017-17541
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code…
6.1
CVE-2017-3126
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the…
6.1
CVE-2016-3195
Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6…
6.1
CVE-2016-3194
Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x…
5.4
CVE-2015-7363
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and…