CVE-2017-3126

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
Fortinet, Inc.Fortinet FortiAnalyzer, FortiManagerFortiAnalyzer 5.4.2, 5.4.1, 5.4.0; FortiManager 5.4.2, 5.4.1, 5.4.0

References

Timeline

Published
May 27, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-31276.1A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands viaCVE-2017-31284.8A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the poliCVE-2017-31296.1A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands CVE-2017-31307.5An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by iCVE-2017-31315.4A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized codCVE-2017-31326.1A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commandCVE-2017-31336.1A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commandCVE-2017-31347.2An escalation of privilege vulnerability in Fortinet FortiWLC-SD versions 8.2.4 and below allows attacker to gain root access via the CLI coCVE-2017-31355.9Under some conditions when using both DNS64 and RPZ to rewrite query responses, query processing can resume in an inconsistent state leadingCVE-2017-31365.9A query with a specific set of characteristics could cause a server using DNS64 to encounter an assertion failure and terminate. An attackerCVE-2017-31377.5Mistaken assumptions about the ordering of records in the answer section of a response containing CNAME or DNAME resource records could leadCVE-2017-31385.3named contains a feature which allows operators to issue commands to a running server by communicating with the server process over a contro
CVE-2017-3126: Medium severity, CVSS 6.1 | Vulnix