What is CVE-2016-8494?

CVE-2016-8494 is a high-severity vulnerability in Fortinet Connect, classified under CWE-264. CVSS score: 7.2/10. Published 2017-02-09.

How severe is CVE-2016-8494?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Fortinet Connect

CVE-2016-8494

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.

EPSS: 0.015 (71.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Connect — versions 14.2, 14.10, 15.10
Fortinet Connect — versions 15.10, 16.7, 14.10

Weakness classification (CWE)

CWE-264

References

psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@fortinet.com (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2016-8494?: CVE-2016-8494 is a high-severity vulnerability in Fortinet Connect, classified under CWE-264. CVSS score: 7.2/10. Published 2017-02-09.
How severe is CVE-2016-8494?: High severity. CVSS v3 base score is 7.2 out of 10.