Lucene search

FortinetVULNRICHMENT:CVE-2023-40717

HistorySep 13, 2023 - 12:29 p.m.

CVE-2023-40717

2023-09-1312:29:45

CWE-798

fortinet

github.com

vulnerability

fortitester

shell commands

database access

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands.

References

fortiguard.com/psirt/FG-IR-22-245