PT-2023-1861 · Fortinet · Fortianalyzer

Published 2023-03-07 · Updated 2023-03-14 · CVE-2023-23776

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 6.4.0 through 6.4.10 FortiAnalyzer versions 7.0.0 through 7.0.4 FortiAnalyzer versions 7.2.0 through 7.2.1

Description The issue is related to insufficient protection of passwords, allowing a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when a log-fetch request is made from the FortiAnalyzer. This may enable an unauthorized actor to gain access to sensitive information.

Recommendations For FortiAnalyzer versions 6.4.0 through 6.4.10, update to a version that fixes the issue. For FortiAnalyzer versions 7.0.0 through 7.0.4, update to a version that fixes the issue. For FortiAnalyzer versions 7.2.0 through 7.2.1, update to a version that fixes the issue. As a temporary workaround, consider restricting access to the log-fetch request functionality until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-312

CWE-200

Related Identifiers

BDU:2023-01460

CVE-2023-23776

Affected Products

Fortianalyzer

References · 6

• https://fortiguard.com/psirt/FG-IR-22-447 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01460 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23776 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23776 · Vendor Advisory
• https://t.me/cibsecurity/59593 · Telegram Post
• https://vuldb.com/ru/?id.222534 · Note