PT-2023-7083 · Fortinet · Fortiadc

Publicado 2023-11-14 · Atualizado 2023-11-20 · CVE-2023-26205

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiADC versions 6.1 through 7.1.2 FortiADC version 7.0

Description The issue is related to improper access control in the FortiADC automation feature, which may allow an authenticated low-privileged attacker to escalate their privileges to super admin via a specific crafted configuration of fabric automation CLI script.

Recommendations For FortiADC versions 6.1 through 7.1.2, consider disabling the automation feature until a patch is available. For FortiADC version 7.0, restrict access to the fabric automation CLI script to minimize the risk of exploitation. As a temporary workaround, consider limiting the privileges of low-privileged attackers to prevent them from escalating their privileges to super admin.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-08110

CVE-2023-26205

Produtos afetados

Fortiadc

Referências · 6

• https://t.me/cvenotify/60782 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1724491735261192377 · Publicação no Twitter
• https://fortiguard.com/psirt/FG-IR-22-292 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26205 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-08110 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-26205 · Nota de Segurança