FortiAuthenticator vulnerabilities

FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.

An out-of-bounds read vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.2 and all versions of 6.5 may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, and all versions of 6.5, 6.4, 6.3 have a forced browsing vulnerability that allows an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints.