by Kastro
Paper/Archive/CVE-2020-12812

CVE-2020-12812

Fortinet FortiOS — Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

KEV · due 3 Mayransomware useEPSS 45%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.8.988 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Affected

ProductAffectedFixed inSource
Fortinet FortiOSFortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

reffortiguard.com/psirt/FG-IR-19-283refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12812kevcisa.gov/known-exploited-vulnerabilities-catalog