4.3
CVE-2023-36638
- EPSS 0.13%
- Veröffentlicht 13.09.2023 13:15:09
- Zuletzt bearbeitet 21.11.2024 08:10:08
- Quelle psirt@fortinet.com
- Teams Watchlist Login
- Unerledigt Login
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 6.0.0 < 6.4.12
Fortinet ≫ Fortianalyzer Version >= 7.0.0 < 7.0.8
Fortinet ≫ Fortianalyzer Version >= 7.2.0 < 7.2.3
Fortinet ≫ Fortimanager Version >= 6.4.0 < 6.4.12
Fortinet ≫ Fortimanager Version >= 7.0.0 < 7.0.8
Fortinet ≫ Fortimanager Version >= 7.2.0 < 7.2.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.341 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| psirt@fortinet.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.