CVE-2023-44256

A server-side request forgery vulnerability CWE-918 in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal...

CVE-2023-44256

CVE-2023-44256 affects Fortinet FortiAnalyzer and FortiManager. A server-side request forgery (SSRF) vulnerability allows a remote, low-privilege attacker to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. Affected: FortiAnalyzer 7.4.0 and 7.2.0–...

CVE-2023-44256

A server-side request forgery vulnerability CWE-918 in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal...

Fortinet FortiAnalyzer Code Issue Vulnerability

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is primarily used to collect network log data and analyze, report, and archive security events, network traffic, and Web content in the logs through the Reporting...

The software’s vulnerability regarding centralized device management by Fortinet FortiManager and the FortiAnalyzer network firewall, related to an error in processing user-controlled authentication keys, allows a perpetrator to access confidential data.

The vulnerability of the software for centralized device management by Fortinet’s FortiManager and FortiAnalyzer lies in a processing error related to authentication keys, which are controlled by users. Exploiting this vulnerability allows an attacker to gain access to confidential data remotely...

The vulnerability of the software for centralized device management by Fortinet’s FortiManager and FortiAnalyzer devices lies in the implementation of security functions at the client side. This allows a malicious actor to gain privileged access.

The vulnerability of the software for centralized device management by Fortinet’s FortiManager and the network firewall FortiAnalyzer is related to the implementation of security functions at the client side. Exploiting this vulnerability can allow a malicious actor to gain privileged access...

The vulnerability of the software interface for centralized device management in Fortinet’s FortiManager, FortiAnalyzer network switches, and FortiADC application delivery controller allows a perpetrator to execute arbitrary commands.

The vulnerability of the software interface for centralized device management in Fortinet’s FortiManager, FortiAnalyzer network monitoring devices, and FortiADC application delivery controller is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allow...

The vulnerability of the command-line interface of the Fortinet FortiManager device and the FortiAnalyzer network switch allows a perpetrator to execute arbitrary commands.

The vulnerability of the command-line interface of the Fortinet FortiManager device management system, as well as the FortiAnalyzer network switch, is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability can allow attackers to execute arbitrary commands...

Vulnerability fixed in FortiManager and FortiAnalyzer

FortiNet has fixed a vulnerability in FortiManager and FortiAnalyzer. The vulnerability involves a "relative path traversal" vulnerability in FortiManager and FortiAnalyzer and could allow a remote malicious party to execute unauthorized code. execute. FortiNet has released updates to fix the...

Fortinet FortiAnalyzer Data Forgery Issue Vulnerability

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

Fortinet Releases Security Updates for Multiple Products

Fortinet has released security advisories addressing vulnerabilities in multiple products. These vulnerabilities may allow cyber threat actors to take control of the affected systems. CISA encourages users and administrators to review the following Fortinet security advisories and apply the...

Fortinet FortiManager and FortiAnalyzer Security Vulnerabilities

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

CVE-2023-44249

An authorization bypass through user-controlled key CWE-639 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests...

CVE-2023-44249

An authorization bypass through user-controlled key CWE-639 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests...

CVE-2023-42788

An improper neutralization of special elements used in an os command 'OS Command Injection' vulnerability CWE-78 in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

CVE-2023-42788

An improper neutralization of special elements used in an os command 'OS Command Injection' vulnerability CWE-78 in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

CVE-2023-42782

A insufficient verification of data authenticity vulnerability CWE-345 in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number...

CVE-2023-42782

A insufficient verification of data authenticity vulnerability CWE-345 in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number...