CVE-2018-9192

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-91937.8A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6.6, the combination oCVE-2018-91945.9A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowlCVE-2018-91955.9Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the kCVE-2018-92057.5Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.CVE-2018-92069.8Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0CVE-2018-92079.8Arbitrary file upload in jQuery Upload File <= 4.0.2CVE-2018-92089.8Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1BetaCVE-2018-92099.8Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2CVE-2018-92309.8In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore paCVE-2018-92327.8Due to the lack of firmware authentication in the upgrade process of T&W WIFI Repeater BE126 devices, an attacker can craft a malicious firmCVE-2018-92337.8Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xmCVE-2018-92347.5GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a