4.1
CVE-2023-44255
- EPSS 0.16%
- Veröffentlicht 12.11.2024 19:15:06
- Zuletzt bearbeitet 21.01.2025 22:02:45
- Quelle psirt@fortinet.com
- Teams Watchlist Login
- Unerledigt Login
An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP or HTTPs requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 6.2.0 < 7.4.3
Fortinet ≫ Fortianalyzer Big Data Version >= 6.2.1 < 7.2.6
Fortinet ≫ Fortimanager Version >= 6.2.0 < 7.4.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.16% | 0.373 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.1 | 2.3 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
|
| psirt@fortinet.com | 4.1 | 2.3 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
|
CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.