The vulnerability of the software for centralized device management by Fortinet’s FortiManager and FortiAnalyzer devices lies in their ability to bypass authentication using a user-controlled key. This allows unauthorized users to gain access to protected information.

🗓️ 25 Dec 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 11 Views

FortiManager and FortiAnalyzer allow authentication bypass via a user controlled key, enabling unauthorized access via a crafted web request.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-44254	10 Sep 202418:25	–	circl
CNNVD	Fortinet FortiAnalyzer和FortiManager 安全漏洞	10 Sep 202400:00	–	cnnvd
CVE	CVE-2023-44254	10 Sep 202414:37	–	cve
Cvelist	CVE-2023-44254	10 Sep 202414:37	–	cvelist
EUVD	EUVD-2023-48613	3 Oct 202520:07	–	euvd
Tenable Nessus	Fortinet FortiAnalyzer Authorization Bypass (FG-IR-23-204)	17 Sep 202400:00	–	nessus
NVD	CVE-2023-44254	10 Sep 202415:15	–	nvd
OSV	CVE-2023-44254	10 Sep 202415:15	–	osv
Positive Technologies	PT-2024-9766 · Fortinet · Fortimanager +1	10 Sep 202400:00	–	ptsecurity
Vulnrichment	CVE-2023-44254	10 Sep 202414:37	–	vulnrichment

Vulners

Node

OR

fortinet fortimanagerMatch7.4.0

fortinet fortianalyzerMatch7.4.0

fortinet fortianalyzer-bigdataRange7.2.0–7.2.5

fortinet fortianalyzerMatch7.0

fortinet fortianalyzerMatch6.4

fortinet fortianalyzerMatch6.2

fortinet fortimanagerMatch7.0

fortinet fortimanagerMatch6.4

fortinet fortimanagerMatch6.2

fortinet fortianalyzerRange7.2.0–7.2.4

fortinet fortimanagerRange7.2.0–7.2.4

Source	Link
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2024091087
fortiguard	www.fortiguard.com/psirt/FG-IR-23-204
web	www.web.nvd.nist.gov/view/vuln/detail
fortiguard	www.fortiguard.com/psirt/FG-IR-23-204

25 Dec 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 24

CVSS 35

EPSS0.00529

FortiManager FortiAnalyzer authentication bypass user controlled key crafted web request unauthorized access