The vulnerability of the Fortinet FortiManager software for centralized device management, as well as the FortiAnalyzer and FortiAnalyzer-BigData tools for event monitoring and analysis, stems from deficiencies in access control to personal information. This allows attackers to read event logs from other domains.

🗓️ 03 Dec 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

Fortinet FortiManager and FortiAnalyzer flaws in access control enable cross-domain access to event logs via crafted requests.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-44255	12 Nov 202419:25	–	circl
CNNVD	Fortinet FortiManager 安全漏洞	12 Nov 202400:00	–	cnnvd
CVE	CVE-2023-44255	12 Nov 202418:53	–	cve
Cvelist	CVE-2023-44255	12 Nov 202418:53	–	cvelist
EUVD	EUVD-2023-48614	3 Oct 202520:07	–	euvd
NVD	CVE-2023-44255	12 Nov 202419:15	–	nvd
OSV	CVE-2023-44255	12 Nov 202419:15	–	osv
Positive Technologies	PT-2023-9784 · Fortinet · Fortianalyzer +2	27 Sep 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-44255	23 May 202501:52	–	redhatcve
Vulnrichment	CVE-2023-44255	12 Nov 202418:53	–	vulnrichment

Vulners

Node

OR

fortinet fortianalyzerMatch7.0

fortinet fortianalyzerMatch6.4

fortinet fortianalyzerMatch6.2

fortinet fortianalyzer-bigdataMatch7.0

fortinet fortianalyzer-bigdataMatch6.4

fortinet fortianalyzer-bigdataMatch6.2

fortinet fortimanagerMatch7.0

fortinet fortimanagerMatch6.4

fortinet fortimanagerMatch6.2

fortinet fortimanagerRange7.4.0–7.4.3

fortinet fortianalyzerRange7.4.0–7.4.3

fortinet fortianalyzerMatch7.2

fortinet fortianalyzer-bigdataRange7.2.0–7.2.6

fortinet fortimanagerMatch7.2

Source	Link
fortiguard	www.fortiguard.fortinet.com/psirt/FG-IR-23-267
vuldb	www.vuldb.com/
web	www.web.nvd.nist.gov/view/vuln/detail
fortiguard	www.fortiguard.com/psirt/FG-IR-23-267

03 Dec 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 24

CVSS 34.1

EPSS0.00553

Fortinet FortiManager FortiAnalyzer access control cross domain event logs crafted requests