Lucene search

FortinetCVE-2023-41679

HistoryOct 10, 2023 - 5:15 p.m.

CVE-2023-41679

2023-10-1017:15:12

CWE-284

fortinet

web.nvd.nist.gov

cve-2023-41679

improper access control

fortimanager

vulnerability

cwe-284

nvd

remote attack

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least “device management” permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs

Affected configurations

Nvd

Node

fortinetfortimanagerRange6.0.0–6.0.12

fortinetfortimanagerRange6.2.0–6.2.12

fortinetfortimanagerRange6.4.0–6.4.11

fortinetfortimanagerRange7.0.0–7.0.7

fortinetfortimanagerMatch7.2.0

fortinetfortimanagerMatch7.2.1

fortinetfortimanagerMatch7.2.2

VendorProductVersionCPE
fortinetfortimanager*cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
fortinetfortimanager7.2.0cpe:2.3:a:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*
fortinetfortimanager7.2.1cpe:2.3:a:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*
fortinetfortimanager7.2.2cpe:2.3:a:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortimanager	*	cpe:2.3:a:fortinet:fortimanager::::::::
fortinet	fortimanager	7.2.0	cpe:2.3:a:fortinet:fortimanager:7.2.0:::::::*
fortinet	fortimanager	7.2.1	cpe:2.3:a:fortinet:fortimanager:7.2.1:::::::*
fortinet	fortimanager	7.2.2	cpe:2.3:a:fortinet:fortimanager:7.2.2:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiManager",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.12",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-23-062

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

21.8%

JSON

Related for CVE-2023-41679