Security feature bypass

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

Improper access control

An improper access control vulnerability CWE-284 in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and...

Authorization

An authorization bypass through user-controlled key CWE-639 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests...

CVE-2023-41679

An improper access control vulnerability CWE-284 in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and...

CVE-2023-41679

An improper access control vulnerability CWE-284 in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and...

CVE-2023-41679

CVE-2023-41679 is an improper access control vulnerability (CWE-284) in FortiManager management interface. The issue affects FortiManager versions 6.0 through 7.2.2 and permits a remote, authenticated attacker who has at least the “device management” permission on their profile and belongs to a s...

CVE-2023-25607

CVE-2023-25607 describes an OS Command Injection in Fortinet management interfaces due to unsafe usage of wordexp. Affected products include FortiManager (versions 6.0–7.2.2), FortiAnalyzer (6.0–7.2.2), and FortiADC (6.0–7.1.0). The vulnerability can allow an authenticated attacker with at least ...

CVE-2023-25607

An improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 throug...

CVE-2023-25607

An improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerability CWE-78 in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 throug...

CVE-2023-41838

Fortinet FortiManager is affected by an OS command injection in the CLI due to improper neutralization of special elements. Affects FortiManager versions 7.2.0–7.2.3 and 7.4.0. The issue could allow execution of unauthorized code or commands via the FortiManager CLI. No exploit status is provided...

CVE-2023-41838

An improper neutralization of special elements used in an os command 'os command injection' in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli...

CVE-2023-41838

An improper neutralization of special elements used in an os command 'os command injection' in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli...

CVE-2023-42788

An improper neutralization of special elements used in an os command 'OS Command Injection' vulnerability CWE-78 in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local...

CVE-2023-42788

An improper neutralization of special elements used in an os command 'OS Command Injection' vulnerability CWE-78 in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through 6.2.11 may allow a local...

CVE-2023-42788

CVE-2023-42788 affects Fortinet FortiManager and FortiAnalyzer. A local attacker with low privileges can exploit an OS Command Injection in CLI handling to run unauthorized code via crafted arguments. Vulnerable versions include 7.4.0; 7.2.0–7.2.3; 7.0.0–7.0.8; 6.4.0–6.4.12; and 6.2.0–6.2.11. Roo...

CVE-2023-42787

A client-side enforcement of server-side security CWE-602 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution...

CVE-2023-42787

Fortinet FortiManager (versions 7.4.0 and before 7.2.3) and FortiAnalyzer (versions 7.4.0 and before 7.2.3) are affected by a client-side enforcement of server-side security vulnerability (CWE-602) that could allow a remote attacker with low privileges to access a privileged web console via clien...

CVE-2023-44249

The CVE affects Fortinet FortiManager (versions 7.4.0 and earlier 7.2.3) and FortiAnalyzer (versions 7.4.0 and earlier 7.2.3). Root cause: an authorization bypass via user-controlled key enables a remote attacker with low privileges to read sensitive information through crafted HTTP requests. Mit...

Fortinet FortiManager and FortiAnalyzer and FortiADC Operating System Command Injection Vulnerability

Fortinet FortiManager and others are products of Fortinet, Inc.Fortinet FortiManager is a centralized network security management platform.Fortinet FortiAnalyzer is a centralized network security reporting solution.Fortinet FortiADC is an application delivery controller. Fortinet FortiADC is an...

Fortinet FortiManager Operating System Command Injection Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and the ability to group devices into different administrative domains ADOMs to further simplify multi-device security deployme...