Description
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
E
Physical
RL
X
RC
Required
Affected products
- fortinet / fortirecorder6.4.0 – 6.4.3
- fortinet / fortirecorder6.0.0 – 6.0.11
Exploits & proofs of concept
- exploit-dbFortiRecorder 6.4.3 - Denial of Serviceby Mohammed Adel
References
Updated 19m ago · 8 sources