4.3
CVE-2023-36638
- EPSS 0.13%
- Published 13.09.2023 13:15:09
- Last modified 21.11.2024 08:10:08
- Source psirt@fortinet.com
- Teams watchlist Login
- Open Login
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 6.0.0 < 6.4.12
Fortinet ≫ Fortianalyzer Version >= 7.0.0 < 7.0.8
Fortinet ≫ Fortianalyzer Version >= 7.2.0 < 7.2.3
Fortinet ≫ Fortimanager Version >= 6.4.0 < 6.4.12
Fortinet ≫ Fortimanager Version >= 7.0.0 < 7.0.8
Fortinet ≫ Fortimanager Version >= 7.2.0 < 7.2.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.341 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| psirt@fortinet.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.