5

CVE-2023-44253

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.

Data is provided by the National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 6.2.0 <= 6.2.12
Fortinet ≫ Fortianalyzer Version >= 6.4.0 <= 6.4.14
Fortinet ≫ Fortianalyzer Version >= 7.0.0 <= 7.0.11
Fortinet ≫ Fortianalyzer Version >= 7.2.0 <= 7.2.3
Fortinet ≫ Fortianalyzer Version7.4.0
Fortinet ≫ Fortianalyzer Version7.4.1
Fortinet ≫ Fortimanager Version >= 6.2.0 <= 6.2.12
Fortinet ≫ Fortimanager Version >= 6.4.0 <= 6.4.14
Fortinet ≫ Fortimanager Version >= 7.0.0 <= 7.0.11
Fortinet ≫ Fortimanager Version >= 7.2.0 <= 7.2.3
Fortinet ≫ Fortimanager Version7.4.0
Fortinet ≫ Fortimanager Version7.4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.33% 0.553
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 3.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
psirt@fortinet.com 5 3.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.