PT-2023-9784 · Fortinet · Fortianalyzer+2

Published 2023-09-27 · Updated 2025-01-21 · CVE-2023-44255

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions prior to 7.4.2 Fortinet FortiAnalyzer versions prior to 7.4.2 Fortinet FortiAnalyzer-BigData versions prior to 7.2.5

Description The issue is related to exposure of sensitive information to an unauthorized actor, which may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP or HTTPS requests. This is due to insufficient access control to personal information.

Recommendations For Fortinet FortiManager versions prior to 7.4.2, update to version 7.4.2 or later. For Fortinet FortiAnalyzer versions prior to 7.4.2, update to version 7.4.2 or later. For Fortinet FortiAnalyzer-BigData versions prior to 7.2.5, update to version 7.2.5 or later. As a temporary workaround, consider restricting access to event logs to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

BDU:2024-10645

CVE-2023-44255

Affected Products

Fortianalyzer

Fortianalyzer-Bigdata

Fortimanager

References · 9

• https://bdu.fstec.ru/vul/2024-10645 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-23-267 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-44255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44255 · Security Note
• https://twitter.com/CVEnew/status/1856722545875030039 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1856532961916486019 · Twitter Post
• https://twitter.com/transilienceai/status/1856752667286278208 · Twitter Post
• https://twitter.com/transilienceai/status/1856752659585536423 · Twitter Post
• https://vuldb.com/?id.284215 · Note