CVE-2023-50180

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-23-433	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortiadc::::::::
	cpe:2.3:a:fortinet:fortiadc::::::::
	cpe:2.3:a:fortinet:fortiadc::::::::
	cpe:2.3:a:fortinet:fortiadc::::::::
	cpe:2.3:a:fortinet:fortiadc:7.4.0:::::::*
	cpe:2.3:a:fortinet:fortiadc:7.4.1:::::::*

History

23 May 2024, 15:55

Type	Values Removed	Values Added
References	~~() https://fortiguard.com/psirt/FG-IR-23-433 -~~	() https://fortiguard.com/psirt/FG-IR-23-433 - Vendor Advisory
First Time		Fortinet fortiadc Fortinet
CPE		cpe:2.3:a:fortinet:fortiadc:::::::: cpe:2.3:a:fortinet:fortiadc:7.4.1:::::::* cpe:2.3:a:fortinet:fortiadc:7.4.0:::::::*
Summary		(es) Una exposición de información confidencial del sistema a una vulnerabilidad de esfera de control no autorizada [CWE-497] en FortiADC versión 7.4.1 e inferior, versión 7.2.3 e inferior, versión 7.1.4 e inferior, versión 7.0.5 e inferior, versión 6.2. 6 y siguientes pueden permitir que un administrador de solo lectura vea datos pertenecientes a otros administradores.

14 May 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-14 17:15

Updated : 2024-05-23 15:55

NVD link : CVE-2023-50180

Mitre link : CVE-2023-50180

CVE.ORG link : CVE-2023-50180

JSON object : View

Products Affected

fortinet

fortiadc

CWE

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

{"id": "CVE-2023-50180", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-05-14T17:15:27.317", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-433", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-497"}]}], "descriptions": [{"lang": "en", "value": "An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins."}, {"lang": "es", "value": "Una exposici\u00f3n de informaci\u00f3n confidencial del sistema a una vulnerabilidad de esfera de control no autorizada [CWE-497] en FortiADC versi\u00f3n 7.4.1 e inferior, versi\u00f3n 7.2.3 e inferior, versi\u00f3n 7.1.4 e inferior, versi\u00f3n 7.0.5 e inferior, versi\u00f3n 6.2. 6 y siguientes pueden permitir que un administrador de solo lectura vea datos pertenecientes a otros administradores."}], "lastModified": "2024-05-23T15:55:49.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "971BE53E-8213-4B4E-B76F-4B446772EC4A", "versionEndIncluding": "6.2.6"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "302D8FF0-69B6-451A-9B5B-E28B2FAA30D8", "versionEndIncluding": "7.0.5", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3CACC8D-C349-4BA9-9900-02A7CEA61FF3", "versionEndIncluding": "7.1.4", "versionStartIncluding": "7.1.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03EA09FD-30DE-4106-96D8-78949E335634", "versionEndIncluding": "7.2.3", "versionStartIncluding": "7.2.0"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C624CB5-F745-4781-839A-B397EC97590B"}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B6FB3F3-79CB-4C0B-99D9-078CEFCF7E6E"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}