CVE-2014-3115: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Fortinet Fo...

Security readout for executives and security teams

Fortinet FortiWeb versions before 5.2.0 had CSRF flaws in the web administration console. If an authenticated admin was tricked into submitting a malicious request, an attacker could potentially perform admin actions, including adding an administrator. Risk depends on whether vulnerable FortiWeb systems still exist and how exposed their admin console is. Likely exposure is legacy FortiWeb appliances or virtual deployments running versions before 5.2.0, especially where administrators access the management console from general-use browsers or networks. Internet-facing management access would increase concern, but the sources do not state exposure prevalence. Treat this as a legacy exposure cleanup item unless vulnerable FortiWeb systems are still present. If any pre-5.2.0 FortiWeb management console remains reachable by administrators, prioritize upgrade and access restriction because compromise could affect a security control plane. Mitigation focus: Upgrade FortiWeb systems before 5.2.0 to 5.2.0 or later.; Review Fortinet advisory FG-IR-14-013 for vendor-specific guidance.; Restrict FortiWeb administration access to trusted management networks..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.