Security readout for executives and security teams
Plain-English summary
FortiPortal 4.0.0 and earlier had an access-control flaw that could let an attacker using another user’s stolen session and CSRF tokens access unauthorized VDOM information or enumerate ADOMs. This threatens tenant or administrative separation in Fortinet management environments, but the provided sources do not include CVSS scoring or confirmed exploitation.
Executive priority
Prioritize assessment if FortiPortal is internet-accessible or used for multi-tenant security management. Treat this as a boundary-control risk rather than a confirmed exploited emergency based on the supplied evidence.
Technical view
The issue is improper access control in Fortinet FortiPortal versions 4.0.0 and below. The CVE describes unauthorized VDOM interaction or ADOM enumeration through another user’s stolen session and CSRF tokens, or through the adomName parameter in /fpc/sec/customer/policy/getAdomVersion. Patch details are not present in the supplied bundle.
Likely exposure
Exposure is limited to organizations running Fortinet FortiPortal 4.0.0 or earlier, especially where FortiPortal manages multiple tenants, VDOMs, or ADOMs. Risk increases if sessions or CSRF tokens can be stolen.
Exploitation context
The bundle does not show CISA KEV listing or active exploitation evidence. The described attack appears to require a valid stolen user session and CSRF tokens, or abuse of an exposed request parameter inside FortiPortal.
Researcher notes
The public bundle lacks CVSS, CWE mapping, fixed-version details, and exploitation confirmation. Analysis should remain bounded to FortiPortal 4.0.0 and below and the access-control behavior described in the CVE record.
Mitigation direction
- Identify any FortiPortal deployments and confirm whether versions are 4.0.0 or earlier.
- Review Fortinet advisory FG-IR-17-114 for vendor-approved fixes or upgrade guidance.
- Restrict FortiPortal access to trusted administrative networks where feasible.
- Invalidate suspicious sessions and rotate credentials if token theft is suspected.
- Monitor FortiPortal activity for unauthorized VDOM or ADOM access patterns.
Validation and detection
- Check FortiPortal version information against the affected range: 4.0.0 and below.
- Confirm whether FortiPortal is used for multi-tenant, VDOM, or ADOM administration.
- Review logs for unexpected access to VDOMs, ADOMs, or getAdomVersion requests.
- Verify remediation status against Fortinet’s PSIRT advisory, not inferred version assumptions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-7337 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/psirt/FG-IR-17-114CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.