CVE-2015-3616
CriticalSummary
CVE-2015-3616 is an SQL injection vulnerability in Fortinet FortiManager versions 5.0.x before 5.0.11 and 5.2.x before 5.2.2, allowing remote attackers to execute arbitrary commands via unspecified parameters.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the system, potentially leading to serious security implications for the organization.
Recommendation
It is recommended to update FortiManager to the latest version to eliminate this vulnerability and implement additional security measures such as log monitoring and access restrictions.
Other vulnerabilities in Fortinet FortiManager
See all- CVE-2015-3617High
Fortinet FortiManager versions 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
- CVE-2015-3614High
Fortinet FortiManager versions 5.0.x before 5.0.11 and 5.2.x before 5.2.2 allow remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability.
- CVE-2016-8495High
CVE-2016-8495 describes an improper certificate validation vulnerability in Fortinet FortiManager versions 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1. This allows a remote attacker to spoof a trusted entity using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature.
- CVE-2024-48884High
A path traversal vulnerability in Fortinet FortiManager, FortiOS, and FortiProxy allows a remote authenticated attacker with access to the Security Fabric interface to write arbitrary files, or an unauthenticated attacker to delete an arbitrary folder.
Original NVD description (English source)
SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.