CVE-2013-4604

{"id": "CVE-2013-4604", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-06-25T14:38:18.117", "references": [{"url": "http://www.fortiguard.com/advisory/FGA-2013-20/", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role."}, {"lang": "es", "value": "Fortinet FortiOS antes de v5.0.3 para dispositivos FortiGate no restringe correctamente las capacidades del invitado, lo que permite a usuarios remotamente leer, modificar o borrar registros o usuarios aprovechando el rol de invitado."}], "lastModified": "2013-06-26T14:45:38.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9FAA990-69D0-4A6F-8BC5-AEA0F5B2A968", "versionEndIncluding": "5.0.2"}, {"criteria": "cpe:2.3:o:fortinet:fortios:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D8A5EC4-CE2C-4174-9F09-361B8D153AD9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}