Lucene search

[email protected]CVE-2023-50180

HistoryMay 14, 2024 - 5:15 p.m.

CVE-2023-50180

2024-05-1417:15:27

CWE-497

[email protected]

web.nvd.nist.gov

exposure of sensitive information

fortiadc

vulnerability cwe-497

unauthorized access

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.

Affected configurations

NVD

Node

fortinetfortiadcRange≤6.2.6

fortinetfortiadcRange7.0.0–7.0.5

fortinetfortiadcRange7.1.0–7.1.4

fortinetfortiadcRange7.2.0–7.2.3

fortinetfortiadcMatch7.4.0

fortinetfortiadcMatch7.4.1

CPENameOperatorVersion
fortinet:fortiadcfortinet fortiadcle6.2.6
fortinet:fortiadcfortinet fortiadcle7.0.5
fortinet:fortiadcfortinet fortiadcle7.1.4
fortinet:fortiadcfortinet fortiadcle7.2.3
fortinet:fortiadcfortinet fortiadceq7.4.0
fortinet:fortiadcfortinet fortiadceq7.4.1

CPE	Name	Operator	Version
fortinet:fortiadc	fortinet fortiadc	le	6.2.6
fortinet:fortiadc	fortinet fortiadc	le	7.0.5
fortinet:fortiadc	fortinet fortiadc	le	7.1.4
fortinet:fortiadc	fortinet fortiadc	le	7.2.3
fortinet:fortiadc	fortinet fortiadc	eq	7.4.0
fortinet:fortiadc	fortinet fortiadc	eq	7.4.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiADC",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.4.0",
        "lessThanOrEqual": "7.4.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.1.0",
        "lessThanOrEqual": "7.1.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-23-433

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2023-50180

vulnrichment1 cvelist1 nvd1