cvelist/2017/14xxx/CVE-2017-14191.json

{
   "CVE_data_meta" : {
      "ASSIGNER" : "psirt@fortinet.com",
      "DATE_PUBLIC" : "2018-03-06T00:00:00",
      "ID" : "CVE-2017-14191",
      "STATE" : "PUBLIC"
   },
   "affects" : {
      "vendor" : {
         "vendor_data" : [
            {
               "product" : {
                  "product_data" : [
                     {
                        "product_name" : "FortiWeb",
                        "version" : {
                           "version_data" : [
                              {
                                 "version_value" : "5.6.0 and above"
                              }
                           ]
                        }
                     }
                  ]
               },
               "vendor_name" : "Fortinet, Inc."
            }
         ]
      }
   },
   "data_format" : "MITRE",
   "data_type" : "CVE",
   "data_version" : "4.0",
   "description" : {
      "description_data" : [
         {
            "lang" : "eng",
            "value" : "An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 and above under \"Signed Security Mode\", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie. A fix is scheduled in upcoming FortiWeb v6.1.0."
         }
      ]
   },
   "problemtype" : {
      "problemtype_data" : [
         {
            "description" : [
               {
                  "lang" : "eng",
                  "value" : "Improper Access Control"
               }
            ]
         }
      ]
   },
   "references" : {
      "reference_data" : [
         {
            "name" : "https://fortiguard.com/advisory/FG-IR-17-279",
            "refsource" : "CONFIRM",
            "url" : "https://fortiguard.com/advisory/FG-IR-17-279"
         },
         {
            "name" : "103430",
            "refsource" : "BID",
            "url" : "http://www.securityfocus.com/bid/103430"
         }
      ]
   }
}