Information disclosure in FortiOS - CVE-2023-37935
Published: October 12, 2023
Vulnerability identifier: #VU81969
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-37935
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to authentication tokens are passed via HTTP GET parameters in plain text in the FortiOS SSL VPN component. A remote attacker with ability to access parameters of HTTP GET request (e.g. by accessing proxy logs) can gain access to sensitive information.
Affected software
FortiOS
RUGGEDCOM APE1808
RUGGEDCOM APE1808
How to mitigate CVE-2023-37935
Install updates from vendor's website.
FortiOS - addressed in versions 7.0.13, 7.2.6, 7.4.1