Fortinet Community
Recently active
Introduction With the latest updates to the Let's Encrypt CA certificate, our goal is to ensure minimal disruption to your operations. Let's Encrypt, a highly trusted Certificate Authority (CA) known for providing free SSL/TLS certificates, is set to introduce significant changes in 2024. These updates are designed to enhance security and performance, but they may also affect how certificates are issued and renewed. In this blog post, we will provide a comprehensive overview of the upcoming changes, detailing what you can expect and how they might impact your current setup. Additionally, we will explain how FortiWeb Cloud is equipped to facilitate a smooth transition. Our solutions are designed to seamlessly integrate with the new Let's Encrypt protocols, ensuring that your operations continue without interruption. We will also address any potential challenges that may arise with legacy devices, offering guidance and best practices to mitigate these issues effectively. 
What is CVE-2024-2879? CVE-2024-2879 is a critical security vulnerability identified in the LayerSlider plugin for WordPress, impacting versions 7.9.11 and 7.10.0. This vulnerability centers around an unauthenticated SQL injection exploit that occurs via the ls_get_popup_markup action. The issue stems from inadequate input sanitization and improper handling of SQL queries within the plugin's code. Exploiting CVE-2024-2879 allows attackers to manipulate SQL queries executed by the plugin, potentially enabling unauthorized access to sensitive information stored in the WordPress site's database. Since the vulnerability can be exploited without requiring authentication, malicious actors can craft specially crafted requests to extract confidential data, modify database content, or execute arbitrary commands. For websites running affected versions of the LayerSlider plugin, the risk posed by CVE-2024-2879 is significant. Unauthorized access to sensitive information could co
We have a specific VLAN setup for some Android Tablets to join, and we built some Android Apps that is hosting in AWS.We would like to limit our Android Tablets to run the Apps that we built, but restricting them to access internet and other stuffs including software updates. Is it possible?Thanks,
I am new to managed fortiswitch configuration.I currently have 60F Fortilinked to manage a 108E with the B port to the switch. Everything seems to be working, however I am worried about bandwidth issues over just the one link. Well, I tried to also connect the A port to the same switch, but the firewall froze up. I assume that having more than on fortilink to the same switch caused some sort of conflict. So, suggestions on how to expand the bandwidth between the firewall and the switch? Is adding an additional fortilink connection correct (and I just screwed it up), or would I be better off adding a connection between the switch-internal vlan and one of the firewall internal interfaces?
Critical Vulnerability CVE-2024-1709 in ConnectWise ScreenConnect What is CVE-2024-1709? CVE-2024-1709 is a critical security vulnerability found in ConnectWise ScreenConnect, impacting versions up to 23.9.7. This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). It enables unauthorized attackers to bypass authentication mechanisms by exploiting a flaw in URL path processing within ScreenConnect's .NET framework. The vulnerability arises from improper handling of URL paths, allowing attackers to manipulate them in a way that circumvents the authentication checks normally enforced by ScreenConnect. This exploit grants unauthorized access to sensitive functionalities or data that would typically require proper authentication. Due to its severity and potential impact, CVE-2024-1709 has been actively exploited in the wild. It has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating
What is CVE-2017-12615? CVE-2017-12615 is a critical vulnerability identified in Apache Tomcat versions 7.0.0 to 7.0.79 running on Windows systems. This vulnerability arises when HTTP PUTs are enabled by setting the `readonly` initialization parameter of the Default servlet to `false`. It permits the unauthorized upload and execution of JSP files via specially crafted requests, leading to potential remote code execution on the server. CVE-2017-12615 is a critical vulnerability found in Apache Tomcat versions 7.0.0 to 7.0.79 operating on Windows systems. This vulnerability is triggered when HTTP PUT requests are enabled by configuring the “readonly” initialization parameter of the Default servlet to “false”. Exploiting this flaw allows attackers to upload malicious JSP files through carefully crafted requests, thereby gaining unauthorized execution privileges on the server. This could potentially lead to remote code execution, posing serious security risks to the affe
How Critical is CVE-2024-30044 Microsoft SharePoint Server? CVE-2024-30044 is a critical remote code execution (RCE) vulnerability discovered in Microsoft SharePoint Server. It has received a CVSSv3 score of 8.8, highlighting its severity. This vulnerability poses a significant risk as it allows authenticated attackers with Site Owner privileges or higher to execute arbitrary code on the SharePoint Server. This means that attackers who exploit this flaw can potentially gain full control over the SharePoint environment, enabling them to manipulate data, compromise confidentiality, and disrupt services. Given its critical nature, administrators are urged to apply patches promptly and implement necessary security measures to protect SharePoint Server instances from exploitation. The Importance of Securing SharePoint Server Microsoft SharePoint Server is a platform that supports organizational functions like document management, collaboration, and web-
What is CVE-2018-11784? CVE-2018-11784 is an open redirect vulnerability impacting several versions of Apache Tomcat, specifically versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90. This vulnerability arises when the default servlet in Apache Tomcat incorrectly handles redirects to directories. For instance, if a user requests '/foo', the server might improperly redirect them to '/foo/' using a specially crafted URL, allowing an attacker to redirect to any URI. This could be exploited to redirect users to malicious websites without their knowledge. The Significance of Mitigating Open Redirect Vulnerabilities Open redirect vulnerabilities are crucial to mitigate because they can serve as a mechanism in phishing attacks, misleading users about the authenticity of a website. When exploited, these vulnerabilities allow attackers to redirect users from legitimate websites to malicious ones. This redirection can deceive users into believing the
Hi Team,We have configured SAML authentication for SSL VPN. Everything works. But Fortigate with os version v7.2.7 works with Forticlient inbuilt Embedded browser but Forti OS v7.4.3 works only when we change the settings to External browser. Please suggest how we can use the Embedded browser itself? We dont use EMS to make changes in XML file :( Regards,Sanjay S
Overview On October 10th, 2023, Google disclosed a zero-day vulnerability in the HTTP/2 protocol, resulting in the most significant attack reaching up to 398 million requests per second. Cybersecurity and Infrastructure Security Agency (CISA) also released an advisory on this DDoS attack on the same day. This vulnerability has been exploited in the wild from August 2023 through October 2023. This HTTP/2 vulnerability allows malicious actors to launch a DDoS attack targeting HTTP/2 servers. The attack sends a set number of HTTP requests to generate high traffic on the targeted HTTP/2 servers. Attackers can cause a significant increase in the request per second and high CPU utilization on the servers that eventually can cause resource exhaustion. FortiGuard Labs identified the Distributed Denial-of-Service (DDoS) attack technique is used in the wild for the CVE-2023-44487 vulnerability. This DDoS attack, known as 'HTTP/2 Rapid Reset', leverages a flaw in the implementatio
GitLab Slack/Mattermost Integration Vulnerability: CVE-2023-5356 What is CVE-2023-5356? The discovery of CVE-2023-5356 adds to the growing list of concerns for GitLab, a widely used platform for software development and version control. This vulnerability involves incorrect authorization checks in both the Community Edition (CE) and Enterprise Edition (EE) of GitLab, affecting versions from 8.13 up to 16.7.2, before specific updates. The security flaw allows a user to abuse Slack/Mattermost integrations to execute slash commands as another user, potentially leading to unauthorized actions within the GitLab environment. This security issue underscores the critical importance of maintaining rigorous security practices in software development and collaboration platforms. The potential for such vulnerabilities to be exploited can have far-reaching implications for both the security of code and the integrity of the development process. What
CVE-2024-3400: Palo Alto Network OS Command Injection Vulnerability in GlobalProtect Introduction A recent zero-day command-injection vulnerability, identified as CVE-2024-3400, has been discovered in Palo Alto Networks PAN-OS. This vulnerability has been assigned the highest possible severity score of 10.0 and can be exploited by an unauthenticated user to execute arbitrary commands on the target system with root privileges. The vulnerability was initially discovered and reported by Volexity. Following this, the Cybersecurity and Infrastructure Security Agency (CISA) included CVE-2024-3400 in its Known Exploited Vulnerability Catalog. In this blog, we will discuss the exploitation activity related to this vulnerability, as observed by Fortinet FortiGuard Labs Threat Intelligences. Additionally, we will explore a newly discovered Python-based backdoor and its unique interaction mechanism with the operator
Hi, I just want to know why the FortiClient on Windows display "Not Reachable" status even if it connected to telemetry. It was happen after connecting it to VPN, Thank you,
Hi everyone, If both web filter and DNS filter are enabled, and someone tries to access a website via a malicious IP (not hostname), which filter would be the first to kick-in? The web filter or the DNS filter? What would happen if the website has not DNS records which filter would be applied here? What if the website does have DNS records, would the reverse DNS process trigger first the DNS filter before the web filter?
I have two fortigate 60F which connected via ipsec (HQ office and branch office)I need to allow users from branch office to connect to HQ's web server. currently i can ping from HQ to branch office users, but not able from branch to HQ's office.I am new to fortigate configuration, guys can u help me what i need to configure?
Hello everyone,I am testing FortiClient EMS trial because we want to get EPP/APT for our clients till end of the year. I went for a direct install of version 7.4 because it runs on Linux. In the Remote Access Profile there is no way to create a SSL VPN tunnel in the gui, I can only see IPsec there.Does someone else having this issue? (Couldn't find it in the known issue list and wanted to ask here before asking official support)
How to register and manage a Fortigate Device behind a dsl router with dynamic ip address? Fortimanager is in LAN private network of a Fortigate behind a dsl router with static public ip. FMG(priv ip)-->FortiGate-->(NAT)-->dsl-router(static ip)-->internet andFGT-->(NAT)-->dsl-router(dynamic ip)-->internet
When I turn on scanning in FortiSandbox for Jpg and jpeg file types, there is a queue of more than 50 days. with which adjustments I can shorten this time.
From 2024-07-03 19:00 till 2024-07-04 05:00 (CEST) we experienced IPS blockage of nearly all traffic on our 200F with IPS FG-VD-56112.0day. I'm pretty sure it was in issue within the database from Fortinet. Does anybody else experienced this? Since it seems to be totally false positive how can one prevent against this, cause every legimit traffic was also blocked by this.
My Fortigate firewall and Fortiswitches are defined and working synchronously on Fortimanager. I want automatic backups of the firewalls and switches on a regular schedule, for example once a week. How can I do this?
Hi, I just migrated from a cisco router to a Fortigate 40F. And since the migration I have had problems with Cisco ISE and MFA authentication. The FGT40F Branch connects to a FGT1000F in HQ, via 2 site-to-site VPNs over the internet in a sdwan zone. Behind the 1000F is the AD server and Cisco ISE. The authorization and authentication path goes through the 2 FGTs to the AD/DNS and ISE servers located in the HQ.PC --- AP ---- FGT60F ------FGT1000F-----Core----AD/DNS/ISE I have no communication problems with ping, traceroute, DNS. I have checked MTU on both FGTs and they have the same size. I also checked Security Profiles (IPS, DNS filtering, AV, DoS policy) At log level the only thing I can see are several events to DNS, AD, ISE destinations with action: Accept ip-conn. Previously the traffic arrived directly to the CORE located in HQ, so it did not go through the FGTs.Does anyone know what it could be?
Hello team, I am a Network specialist and worked a lot with FortiGate firewalls, For the first time I wanted to try this FortiGate VM image "FGT-VMv7.4.1.F" on Vmware workstation pro to do a basic LAB, I have configured everything correctly but for some reason the traffic can never go through the FortiGate, it seems that the firewall policy to allow traffic from one port to another doesn't do anything, I am 100 % sure that my config is correct (NAT, allow incoming traffic from Port1 to Port2 as an example, Service "ALL"...etc"The weird thing is that everything works with it (Interfaces are fine and do respond to Ping, IPSEC "SDWAN" Tunnel are Up and responding) except the firewall policy doesn't do anything. Is there a specific license for the FGT VM to make the firewall policy work properly ? Thank you,
Hello community,A few weeks ago we migrated the AWS vpn from static to BGP, and since then we have noticed that there are several Hold Timer Expired messages received “IP AWS”. I have checked physical cables, and connectivity and there are no problems. The problem is also not due to saturation because it occurs at night when there is no staff working.What else could it be, or if anyone else has had this happen.
I have 50+ remote branch offices that use Fortigates with a single WAN connection, which uses one IPsec tunnel back into our Primary HQ. However, we would like to add a second IPsec tunnel as a backup path at another location at Secondary HQ FG. Is there more than one way to set this up? If so, what are those setups, and which is more feasible to do? My end goal is when the IPsec tunnel goes down because Primary HQ route is not active, it should route to the Secondary HQ automatically. Also, FG is running firmware 7.2. I heard others recommend using two IPsec tunnels and also creating a BGP neighbor as an option. I wasn't sure if there were any other ideas.
What is the difference? Any pro's con's to one or the other? Why would you need DNS filtering if you're already doing web filtering? If you do not use the FortiGate as a DNS server does DNS filter do anything?
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
