Unverified password change over the GUI

Summary

An unverified password change vulnerability [CWE-620] in FortiADC may allow an authenticated attacker to bypass the Old Password check in the password change form for the account the attacker is logged into or for others accounts except admin when the attacker has Read Write access on System via a crafted HTTP request .

Affected Products

At least
FortiADC version 6.2.0 through 6.2.3
FortiADC 6.1 all versions
FortiADC 6.0 all versions
FortiADC 5.4 all versions
FortiADC 5.3 all versions
FortiADC 5.2 all versions
FortiADC 5.1 all versions
FortiADC 5.0 all versions

Solutions

Please upgrade to FortiADC version 7.0.0 or above,

Please upgrade to FortiADC version 6.2.4 or above.

Acknowledgement

Internally discovered and reported by Théo Leleu of Fortinet Product Security team.