PT-2023-6409 · Fortinet · Fortianalyzer+1

François-Xavier Picard

+3

·

Published

2023-10-10

·

Updated

2023-10-31

·

CVE-2023-44256

CVSS v3.1

6.5

Medium

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.2.0 through 7.2.3 and before 7.0.8 FortiAnalyzer version 7.4.0 FortiManager versions 7.2.0 through 7.2.3 and before 7.0.8 FortiManager version 7.4.0
Description A server-side request forgery issue allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. The vulnerability is related to insufficient validation of incoming requests.
Recommendations For FortiAnalyzer versions 7.2.0 through 7.2.3 and before 7.0.8, update to a version that includes the fix for this issue. For FortiAnalyzer version 7.4.0, update to a version that includes the fix for this issue. For FortiManager versions 7.2.0 through 7.2.3 and before 7.0.8, update to a version that includes the fix for this issue. For FortiManager version 7.4.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable HTTP request functionality until a patch is available.

Exploit

Fix

SSRF

Path traversal

Weakness Enumeration

CWE-918CWE-22

Related Identifiers

BDU:2023-07123
CVE-2023-44256
GHSA-2HC5-P5MC-8VRH

Affected Products

Fortianalyzer
Fortimanager