Fortinet FortiAuthenticator Improper Access Control Vulnerability Allowing Unauthorized Code Execution

A vulnerability allowing improper access control has been identified in Fortinet FortiAuthenticator versions 8.0.2, 8.0.0, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6. This vulnerability may allow an unauthenticated attacker to execute unauthorized code or commands by sending crafted requests to the application.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the affected system.

Remediation

Users of Fortinet FortiAuthenticator should upgrade to version 8.0.3 or above if they are on FortiAuthenticator 8.0, and to version 6.6.9 or 6.5.7 or above if they are on FortiAuthenticator 6.6 or 6.5 respectively. FortiAuthenticator Cloud is not impacted by this vulnerability.