PT-2023-6409 · Fortinet · Fortianalyzer+1
François-Xavier Picard
+3
·
Publicado
2023-10-10
·
Atualizado
2023-10-31
·
CVE-2023-44256
CVSS v3.1
6.5
Média
| Vetor | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FortiAnalyzer versions 7.2.0 through 7.2.3 and before 7.0.8
FortiAnalyzer version 7.4.0
FortiManager versions 7.2.0 through 7.2.3 and before 7.0.8
FortiManager version 7.4.0
Description
A server-side request forgery issue allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. The vulnerability is related to insufficient validation of incoming requests.
Recommendations
For FortiAnalyzer versions 7.2.0 through 7.2.3 and before 7.0.8, update to a version that includes the fix for this issue.
For FortiAnalyzer version 7.4.0, update to a version that includes the fix for this issue.
For FortiManager versions 7.2.0 through 7.2.3 and before 7.0.8, update to a version that includes the fix for this issue.
For FortiManager version 7.4.0, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the vulnerable HTTP request functionality until a patch is available.
Exploit
Correção
SSRF
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fortianalyzer
Fortimanager