CVE-2023-41676

2023-11-1418:15:52

CWE-200

CWE-522

[email protected]

web.nvd.nist.gov

cwe-200

unauthorized access

windows agent logs

password

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

18.1%

JSON

An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windows agent logs to obtain the windows agent password via searching through the logs.

Affected configurations

Nvd

Node

fortinetfortisiemRange6.7.0–6.7.5

fortinetfortisiemMatch7.0.0

VendorProductVersionCPE
fortinetfortisiem*cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*
fortinetfortisiem7.0.0cpe:2.3:a:fortinet:fortisiem:7.0.0:*:*:*:*:*:*:*