CVEvulnerability
CVE-2018-9194
5.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-09-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-203
Description
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.
Affected configurations
• fortinet fortios (>= 5.4.6 <= 5.4.9)
• fortinet fortios 6.0.0
• fortinet fortios 6.0.1
Related
Weakness · CWE (1)
- CWE-203 Observable Discrepancy weakness
References
- https://fortiguard.com/advisory/FG-IR-17-302 Vendor Advisory
- https://robotattack.org/ Third Party Advisory
- https://www.kb.cert.org/vuls/id/144389 Third Party Advisory, US Government Resource
- https://fortiguard.com/advisory/FG-IR-17-302 Vendor Advisory
- https://robotattack.org/ Third Party Advisory
- https://www.kb.cert.org/vuls/id/144389 Third Party Advisory, US Government Resource