CVE-2017-14191

5.9 mediumEPSS 1.0%

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie.

Severity

CVSS 3.0

5.9 medium

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
Published: 2018-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiweb

References

http://www.securityfocus.com/bid/103430
https://fortiguard.com/advisory/FG-IR-17-279
http://www.securityfocus.com/bid/103430
https://fortiguard.com/advisory/FG-IR-17-279

Check your stack JSON