CVE-2015-3616

EPSS 0.84%
Published 11.08.2017 21:29:00
Last modified 20.04.2025 01:37:25
Source cve@mitre.org
Teams watchlist Login
Open Login

SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Fortinet ≫ Fortimanager Firmware Version5.0.0

   Fortinet ≫ Fortimanager 2000e Version-
   Fortinet ≫ Fortimanager 200d Version-
   Fortinet ≫ Fortimanager 3000f Version-
   Fortinet ≫ Fortimanager 300e Version-
   Fortinet ≫ Fortimanager 3900e Version-
   Fortinet ≫ Fortimanager 400e Version-

Fortinet ≫ Fortimanager Firmware Version5.0.1

Fortinet ≫ Fortimanager Firmware Version5.0.2

Fortinet ≫ Fortimanager Firmware Version5.0.3

Fortinet ≫ Fortimanager Firmware Version5.0.4

Fortinet ≫ Fortimanager Firmware Version5.0.5

Fortinet ≫ Fortimanager Firmware Version5.0.6

Fortinet ≫ Fortimanager Firmware Version5.0.7

Fortinet ≫ Fortimanager Firmware Version5.0.8

Fortinet ≫ Fortimanager Firmware Version5.0.9

Fortinet ≫ Fortimanager Firmware Version5.0.10

Fortinet ≫ Fortimanager Firmware Version5.2.0

Fortinet ≫ Fortimanager Firmware Version5.2.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.84%	0.726

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://www.securityfocus.com/bid/74444

http://www.securitytracker.com/id/1032188

Third Party Advisory

VDB Entry

https://fortiguard.com/psirt/FG-IR-15-011

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2015-3616

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-3616

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-3616

EUVD