PT-2024-3043 · Fortinet · Fortimanager

Published 2024-04-09 · Updated 2025-01-17 · CVE-2023-47542

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiManager versions 7.4.1 and below FortiManager versions 7.2.4 and below FortiManager version 7.0.10 and below

Description The issue is related to an improper neutralization of special elements used in a template engine, which allows an attacker to execute unauthorized code or commands via specially crafted templates. This can be exploited by creating and using malicious templates to gain unauthorized access or control.

Recommendations For FortiManager versions 7.4.1 and below, update to a version above 7.4.1 to resolve the issue. For FortiManager versions 7.2.4 and below, update to a version above 7.2.4 to resolve the issue. For FortiManager version 7.0.10 and below, update to a version above 7.0.10 to resolve the issue. As a temporary workaround, consider restricting the use of the template engine or limiting access to it until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

BDU:2024-03227

CVE-2023-47542

Affected Products

Fortimanager

References · 8

• https://fortiguard.com/psirt/FG-IR-23-419 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47542 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03227 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47542 · Security Note
• https://twitter.com/CVEnew/status/1777707956878152038 · Twitter Post
• https://t.me/cvenotify/76164 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024040957 · Note
• https://twitter.com/VulmonFeeds/status/1777739517685903427 · Twitter Post