Lucene search

[email protected]CVE-2023-28002

HistoryNov 14, 2023 - 6:15 p.m.

CVE-2023-28002

2023-11-1418:15:29

CWE-354

[email protected]

web.nvd.nist.gov

cve-2023-28002

fortios

fortiproxy

cwe-354

security vulnerability

integrity check

local attacker

admin privileges

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.2 all versions, 7.0 all versions, 2.0 all versions VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxyle2.0.13
fortinet:fortiproxyfortinet fortiproxyeq2.0.12
fortinet:fortiproxyfortinet fortiproxyeq2.0.7
fortinet:fortiproxyfortinet fortiproxyeq2.0.5
fortinet:fortiproxyfortinet fortiproxyeq2.0.6
fortinet:fortiproxyfortinet fortiproxyeq2.0.4
fortinet:fortiproxyfortinet fortiproxyeq2.0.3
fortinet:fortiproxyfortinet fortiproxyeq2.0.10
fortinet:fortiproxyfortinet fortiproxyeq2.0.1
fortinet:fortiproxyfortinet fortiproxyeq2.0.2

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	le	2.0.13
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.12
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.7
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.5
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.6
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.4
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.3
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.10
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.1
fortinet:fortiproxy	fortinet fortiproxy	eq	2.0.2

Rows per page:

1-10 of 1041

References

fortiguard.com/psirt/FG-IR-22-396

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.2 High

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for CVE-2023-28002

nessus1 prion1 cvelist1 ics1