A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.
References
| Link | Resource |
|---|---|
| https://fortiguard.com/psirt/FG-IR-23-187 | Vendor Advisory |
| https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Dec 2023, 01:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr - Exploit, Third Party Advisory |
18 Oct 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Oct 2023, 15:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fortinet fortianalyzer
Fortinet fortimanager Fortinet |
|
| CWE | NVD-CWE-Other | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://fortiguard.com/psirt/FG-IR-23-187 - Vendor Advisory |
10 Oct 2023, 17:52
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-10 17:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-42787
Mitre link : CVE-2023-42787
CVE.ORG link : CVE-2023-42787
JSON object : View
Products Affected
fortinet
- fortimanager
- fortianalyzer
CWE