CVE-2017-7342

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via a hidden Close button

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Fortinet, Inc.	Fortinet FortiPortal	FortiPortal versions 4.0.0 and below

References

https://fortiguard.com/psirt/FG-IR-17-114Third Party Advisory
https://fortiguard.com/psirt/FG-IR-17-114Third Party Advisory

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-73436.1An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url CVE-2017-73448.1A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting t CVE-2017-73455.3NetApp OnCommand Performance Manager and OnCommand Unified Manager for Clustered Data ONTAP before 7.1P1 improperly bind the Java Management CVE-2017-73465.5The vmw_gb_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.7 does not validate cer CVE-2017-73518.8A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload.CVE-2017-73525.4Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web scrip CVE-2017-73579.1Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by import CVE-2017-73587.3In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path loc CVE-2017-73596.1Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.CVE-2017-73606.1Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.CVE-2017-73616.1Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.CVE-2017-73626.1Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.