« Volver al listado

CVE-2019-15709

Estado: ModificadaMedia (6.5)—

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Fortinet — Fortiap-sFortinet — Fortiap-uFortinet — Fortiap-w2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-15709",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2019-15709",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T13:59:17.609971Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 9.2,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Fortinet FortiAP-S/W2, FortiAP-U",
          "versions": [
            {
              "status": "affected",
              "version": "FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-01T19:15:09.800",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-19-298",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-19-298",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI."
    },
    {
      "lang": "es",
      "value": "Una comprobación de entrada inapropiada en FortiAP-S/W2 versiones 6.2.0 hasta 6.2.2, versiones 6.0.5 y por debajo, FortiAP-U versiones 6.0.1 y por debajo, la consola de administración de la CLI puede permitir a administradores no autorizados sobrescribir los archivos de sistema por medio comandos tcpdump especialmente diseñados en la CLI."
    }
  ],
  "lastModified": "2026-06-17T02:20:55.057",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20474B39-661E-4425-8007-2C2597382AFD",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-s:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "070E514F-CAAA-41B7-A2F3-B1413523AFD9",
              "versionEndIncluding": "6.2.2",
              "versionStartIncluding": "6.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortiap-s:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "08EA632B-0568-4EDB-81E1-E2772389E106"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-w2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D117E145-EB84-4BE5-B4F6-6262F8BDE56F",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-w2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC5D6562-A598-42AC-AFD6-4C6DF215479A",
              "versionEndIncluding": "6.2.2",
              "versionStartIncluding": "6.2.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-w2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "94DC1717-87D3-4BCA-8919-431D30D307D6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortiap-u:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AD25BC2-1FDE-45EB-8887-6FC680614B84",
              "versionEndIncluding": "6.0.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortiap-u:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8197EC87-A2AE-4D42-90DD-96A3A7B26E76"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}