Lucene search

FortinetVULNRICHMENT:CVE-2023-44254

HistorySep 10, 2024 - 2:37 p.m.

CVE-2023-44254

2024-09-1014:37:45

CWE-639

fortinet

github.com

authorization bypass

fortianalyzer

fortimanager

cwe-639

vulnerability

remote attacker

sensitive data

http request

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P

AI Score

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request.

References

fortiguard.com/psirt/FG-IR-23-204

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P

AI Score

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-44254