Authorization

2023-10-1017:15:00

PRIOn knowledge base

www.prio-n.com

authorization bypass

fortimanager

fortianalyzer

vulnerability

remote attacker

sensitive information

crafted http requests

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.9%

JSON

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests.

CPENameOperatorVersion
fortianalyzerge6.2.0
fortianalyzerle6.2.12
fortianalyzereq7.4.0
fortianalyzerge7.0.0
fortianalyzerle7.0.9
fortianalyzerge6.4.0
fortianalyzerle6.4.13
fortianalyzerge7.2.0
fortianalyzerlt7.2.4
fortimanagerge6.2.0

Name	Operator	Version
fortianalyzer	ge	6.2.0
fortianalyzer	le	6.2.12
fortianalyzer	eq	7.4.0
fortianalyzer	ge	7.0.0
fortianalyzer	le	7.0.9
fortianalyzer	ge	6.4.0
fortianalyzer	le	6.4.13
fortianalyzer	ge	7.2.0
fortianalyzer	lt	7.2.4
fortimanager	ge	6.2.0