fortinet fortios CVE-2020-12812 is a vulnerability in Fortinet Fortios
Published on July 24, 2020

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Vendor Advisory NVD

Known Exploited Vulnerability

This Fortinet FortiOS SSL VPN 2FA Authentication Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

The following remediation steps are recommended / required by May 3, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2020-12812 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is an authentification Vulnerability?

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

CVE-2020-12812 has been classified to as an authentification vulnerability or weakness.

Improper Handling of Case Sensitivity

The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.


Products Associated with CVE-2020-12812

You can be notified by stack.watch whenever vulnerabilities like CVE-2020-12812 are published in these products:

Fortinet Fortios
 

What versions of Fortios are vulnerable to CVE-2020-12812?