PT-2023-21471 · Fortinet · Fortipresence

Published 2023-09-13 · Updated 2023-09-15 · CVE-2023-27998

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiPresence versions 1.0 through 1.2.1

Description A lack of custom error pages may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.

Recommendations For FortiPresence versions 1.0 through 1.2.1, consider implementing custom error pages to prevent sensitive information disclosure. As a temporary workaround, restrict access to the login GUI to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-756

Related Identifiers

CVE-2023-27998

Affected Products

Fortipresence

References · 5

• https://fortiguard.com/psirt/FG-IR-22-288 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27998 · Security Note
• https://t.me/cibsecurity/70376 · Telegram Post
• https://twitter.com/CVEnew/status/1701942524372263067 · Twitter Post