Multiple vulnerabilities in Fortinet FortiAnalyzer and FortiManager
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2023-42782 CVE-2023-42787 CVE-2023-44249 |
| CWE-ID | CWE-345 CWE-602 CWE-639 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
FortiAnalyzer Server applications / IDS/IPS systems, Firewalls and proxy servers FortiManager Server applications / IDS/IPS systems, Firewalls and proxy servers |
| Vendor | Fortinet, Inc |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Insufficient verification of data authenticity
EUVDB-ID: #VU81954
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-42782
CWE-ID:
CWE-345 - Insufficient Verification of Data Authenticity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient verification of data authenticity. A remote attacker can send messages to the syslog server via the knoweldge of an authorized device serial number.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFortiAnalyzer: 6.2.0 - 7.4.0
External linkshttp://fortiguard.com/psirt/FG-IR-23-221
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Client-Side Enforcement of Server-Side Security
EUVDB-ID: #VU81958
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-42787
CWE-ID:
CWE-602 - Client-Side Enforcement of Server-Side Security
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a client-side enforcement of server-side security issue. A remote user can access a privileged web console via client side code execution.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFortiManager: 6.2.0 - 7.4.0
FortiAnalyzer: 6.2.0 - 7.4.0
External linkshttp://fortiguard.com/psirt/FG-IR-23-187
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Authorization bypass through user-controlled key
EUVDB-ID: #VU81956
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-44249
CWE-ID:
CWE-639 - Authorization Bypass Through User-Controlled Key
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to authorization bypass through user-controlled key. A remote user can send a specially crafted HTTP request and read sensitive information.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFortiManager: 6.2.0 - 7.4.0
FortiAnalyzer: 6.2.0 - 7.4.0
External linkshttp://fortiguard.com/psirt/FG-IR-23-201
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
