CVE-2023-44249

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*

History

21 Dec 2023, 01:05

Type Values Removed Values Added
References (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-x8rp-jfwc-gqqj - (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-x8rp-jfwc-gqqj - Third Party Advisory

25 Oct 2023, 18:17

Type Values Removed Values Added
References
  • (MISC) https://github.com/orangecertcc/security-research/security/advisories/GHSA-x8rp-jfwc-gqqj -

12 Oct 2023, 20:35

Type Values Removed Values Added
CWE CWE-639
First Time Fortinet fortianalyzer
Fortinet fortimanager
Fortinet
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5
References (MISC) https://fortiguard.com/psirt/FG-IR-23-201 - (MISC) https://fortiguard.com/psirt/FG-IR-23-201 - Vendor Advisory
CPE cpe:2.3:a:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*

10 Oct 2023, 17:52

Type Values Removed Values Added
New CVE

Information

Published : 2023-10-10 17:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-44249

Mitre link : CVE-2023-44249

CVE.ORG link : CVE-2023-44249


JSON object : View

Products Affected

fortinet

  • fortimanager
  • fortianalyzer
CWE
CWE-639

Authorization Bypass Through User-Controlled Key