PT-2023-7381 · Fortinet+1 · Fortisiem+1

Published 2023-11-14 · Updated 2023-11-18 · CVE-2023-45585

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiSIEM versions 5.3.3 and below FortiSIEM versions 5.4.0 FortiSIEM versions 6.1.2 and below FortiSIEM versions 6.2.1 and below FortiSIEM versions 6.3.3 and below FortiSIEM versions 6.4.2 and below FortiSIEM versions 6.5.1 and below FortiSIEM versions 6.6.3 and below FortiSIEM versions 6.7.6 and below FortiSIEM version 7.0.0

Description The issue is related to the insertion of sensitive information into log files, which may allow an authenticated user to view an encrypted ElasticSearch password via debug log files generated when FortiSIEM is configured with ElasticSearch Event Storage. This is due to insufficient protection of registration data.

Recommendations For FortiSIEM versions 5.3.3 and below, consider disabling the ElasticSearch Event Storage feature until a patch is available. For FortiSIEM versions 5.4.0, restrict access to debug log files to minimize the risk of exploitation. For FortiSIEM versions 6.1.2 and below, avoid using the debug log files feature in conjunction with ElasticSearch Event Storage. For FortiSIEM versions 6.2.1 and below, limit access to the encrypted ElasticSearch password. For FortiSIEM versions 6.3.3 and below, consider implementing additional security measures to protect registration data. For FortiSIEM versions 6.4.2 and below, restrict access to the ElasticSearch Event Storage configuration. For FortiSIEM versions 6.5.1 and below, disable the debug log files feature when not necessary. For FortiSIEM versions 6.6.3 and below, limit access to the debug log files generated by FortiSIEM. For FortiSIEM versions 6.7.6 and below, consider implementing a secure logging mechanism. For FortiSIEM version 7.0.0, restrict access to the ElasticSearch password and consider disabling the ElasticSearch Event Storage feature until a patch is available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-08413

CVE-2023-45585

Affected Products

Elasticsearch

Fortisiem

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-45585 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-392 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45585 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08413 · Security Note
• https://t.me/cvenotify/60680 · Telegram Post
• https://twitter.com/CVEnew/status/1724491736288731219 · Twitter Post