FortinetCVELIST:CVE-2023-36638CVE-2023-36638
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RC:C
4.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
14.0%
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
CNA Affected
[
{
"vendor": "Fortinet",
"product": "FortiManager",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"version": "7.2.0",
"lessThanOrEqual": "7.2.2",
"status": "affected"
},
{
"versionType": "semver",
"version": "7.0.0",
"lessThanOrEqual": "7.0.7",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.4.0",
"lessThanOrEqual": "6.4.11",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.2.0",
"lessThanOrEqual": "6.2.11",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.0.0",
"lessThanOrEqual": "6.0.12",
"status": "affected"
}
]
},
{
"vendor": "Fortinet",
"product": "FortiAnalyzer",
"defaultStatus": "unaffected",
"versions": [
{
"versionType": "semver",
"version": "7.2.0",
"lessThanOrEqual": "7.2.2",
"status": "affected"
},
{
"versionType": "semver",
"version": "7.0.0",
"lessThanOrEqual": "7.0.7",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.4.0",
"lessThanOrEqual": "6.4.11",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.2.0",
"lessThanOrEqual": "6.2.11",
"status": "affected"
},
{
"versionType": "semver",
"version": "6.0.0",
"lessThanOrEqual": "6.0.12",
"status": "affected"
}
]
}
]References
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RC:C
4.9 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
14.0%