PT-2023-7754 · Fortinet · Fortiweb

Published 2023-12-12 · Updated 2023-12-19 · CVE-2023-46713

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.2.0 through 6.2.8 Fortinet FortiWeb versions 6.3.0 through 6.3.23 Fortinet FortiWeb versions 7.0.0 through 7.0.9 Fortinet FortiWeb versions 7.2.0 through 7.2.5 Fortinet FortiWeb version 7.4.0

Description The issue is related to improper output neutralization for logs in Fortinet FortiWeb, which may allow an attacker to forge traffic logs via a crafted URL of the web application. This can be exploited by a remote attacker.

Recommendations For Fortinet FortiWeb versions 6.2.0 through 6.2.8, update to a version outside of this range to resolve the issue. For Fortinet FortiWeb versions 6.3.0 through 6.3.23, update to a version outside of this range to resolve the issue. For Fortinet FortiWeb versions 7.0.0 through 7.0.9, update to a version outside of this range to resolve the issue. For Fortinet FortiWeb versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue. For Fortinet FortiWeb version 7.4.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

BDU:2023-08821

CVE-2023-46713

Affected Products

Fortiweb

References · 7

• https://fortiguard.com/psirt/FG-IR-23-256 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46713 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46713 · Vendor Advisory
• https://t.me/cvenotify/64222 · Telegram Post
• https://twitter.com/CVEnew/status/1734828598446428515 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1734906690988830757 · Twitter Post