Lucene search

FortinetCVE-2023-46713

HistoryDec 13, 2023 - 7:15 a.m.

CVE-2023-46713

2023-12-1307:15:24

CWE-117

fortinet

web.nvd.nist.gov

cve-2023

cve

fortinet

fortiweb

log forging

security vulnerability

nvd

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application.

Affected configurations

Nvd

Node

fortinetfortiwebRange6.2.0–6.2.8

fortinetfortiwebRange6.3.0–6.3.23

fortinetfortiwebRange7.0.0–7.0.9

fortinetfortiwebRange7.2.0–7.2.5

fortinetfortiwebMatch7.4.0

VendorProductVersionCPE
fortinetfortiweb*cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
fortinetfortiweb7.4.0cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiweb	*	cpe:2.3:a:fortinet:fortiweb::::::::
fortinet	fortiweb	7.4.0	cpe:2.3:a:fortinet:fortiweb:7.4.0:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.4.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.23",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.8",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-23-256

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-46713