FortiWeb Authentication Bypass

Fortinet's FortiWeb is a web application firewall that protects against various threats. This vulnerability allows an attacker to bypass authentication using password hashes instead of passwords, potentially leading to unauthorized access to sensitive data and systems.

You're affected if you use A use of password. Affected versions: 8.0.1, 7.4.10, 7.2.11, 7.6.5, 7.0.11 If you don't recognise this software, you're probably not affected.

1. Upgrade to FortiWeb 8.0.2 or above from the official Fortinet website: https://support.fortinet.com/kb/DOC-12345
2. If immediate upgrade isn't possible:
3. Restrict network access to your FortiWeb instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• Vendor Advisory