CVE-2016-4966

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdfRelease Notes, Third Party Advisory
http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilitiesThird Party Advisory
http://www.securityfocus.com/bid/92781Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/724487Third Party Advisory, US Government Resource
http://docs.fortinet.com/uploaded/files/3236/fortiwan-v4.2.5-release-notes.pdfRelease Notes, Third Party Advisory
http://fortiguard.com/advisory/fortiwan-multiple-vulnerabilitiesThird Party Advisory
http://www.securityfocus.com/bid/92781Third Party Advisory, VDB Entry
https://www.kb.cert.org/vuls/id/724487Third Party Advisory, US Government Resource

Timeline

Published: Sep 21, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49676.5Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of CVE-2016-49686.5The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover a CVE-2016-49696.1Cross-site scripting (XSS) vulnerability in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote attackers to inject arbitrary CVE-2016-49707.5handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of CVE-2016-49718.8GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.CVE-2016-49729.8OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka)CVE-2016-49737.8Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform CVE-2016-49747.5Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpat CVE-2016-49756.1Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made i CVE-2016-49765.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive CVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_t CVE-2016-49787.2The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in