CVE-2017-14189

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
Fortinet, Inc.	FortiWebManager	5.8.0

References

http://www.securityfocus.com/bid/101953Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039892Third Party Advisory, VDB Entry
https://fortiguard.com/advisory/FG-IR-17-248Vendor Advisory
http://www.securityfocus.com/bid/101953Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039892Third Party Advisory, VDB Entry
https://fortiguard.com/advisory/FG-IR-17-248Vendor Advisory

Timeline

Published: Nov 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-141906.1A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrar CVE-2017-141915.9An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attac CVE-2017-141926.1The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.CVE-2017-141936.1The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-141946.1The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.CVE-2017-141956.1The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explo CVE-2017-141967.5An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and 5.4.1.3. An information disclosure caused by a Path Traversal issue CVE-2017-141976.1An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. There are multiple reflected Cross-Site Scripting (XSS) iss CVE-2017-141988.8An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets CVE-2017-141999.8A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.CVE-2017-142017.8Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote co CVE-2017-142027.8Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or te