PT-2023-1735 · Fortinet · Fortideceptor

CVE-2023-26209 · Publicado 2023-03-07 · Atualizado 2023-03-15

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Fortinet FortiDeceptor versions 3.1.x and earlier

Description The issue is related to insufficient restriction of excessive authentication attempts, allowing a remote attacker to cause a denial of service by sending specially crafted HTTP requests. This can lead to partial exhaustion of CPU and memory resources. The attacker can send numerous HTTP requests to the login form to exploit this issue.

Recommendations For Fortinet FortiDeceptor versions 3.1.x and earlier, consider restricting access to the login form to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the number of authentication attempts to prevent excessive requests from overwhelming the system. Avoid using the login form with untrusted or unverified sources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

BDU:2023-01326

CVE-2023-26209

Produtos afetados

Fortideceptor

Referências · 5

• https://fortiguard.com/psirt/FG-IR-20-078 · Aviso do Fabricante
• https://t.me/cibsecurity/59725 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26209 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-26209 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01326 · Nota de Segurança