CVE-2019-15705

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Fortinet	FortiGate	FortiOS versions 6.2.1 and below; FortiOS versions 6.0.6 and below

References

https://fortiguard.com/advisory/FG-IR-19-236Vendor Advisory
https://fortiguard.com/advisory/FG-IR-19-236Vendor Advisory

Timeline

Published: Nov 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-157065.4An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below an CVE-2019-157074.9An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perfor CVE-2019-157086.7A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.CVE-2019-157096.5An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthor CVE-2019-15714.8The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server CVE-2019-157107.2An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized admini CVE-2019-157117.8A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands un CVE-2019-157127.2An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access CVE-2019-157136.1The my-calendar plugin before 3.1.10 for WordPress has XSS.CVE-2019-157145.3cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory traversal attack in un CVE-2019-157157.2MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.CVE-2019-157165.5WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read passwords or API keys i