PT-2024-3556 · Fortinet · Fortiadc

Published 2024-05-14 · Updated 2024-05-23 · CVE-2023-50180

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiADC versions 7.4.1 and below FortiADC versions 7.2.3 and below FortiADC versions 7.1.4 and below FortiADC versions 7.0.5 and below FortiADC versions 6.2.6 and below

Description The issue is related to an exposure of sensitive system information to an unauthorized control sphere, which may allow a read-only admin to view data pertaining to other admins. This could potentially be exploited by an attacker to access arbitrary data.

Recommendations For FortiADC versions 7.4.1 and below, consider restricting access to sensitive system information until a patch is available. For FortiADC versions 7.2.3 and below, restrict the privileges of read-only admins to minimize the risk of data exposure. For FortiADC versions 7.1.4 and below, limit the access of read-only admins to sensitive data. For FortiADC versions 7.0.5 and below, apply configuration changes to restrict the viewing of data pertaining to other admins. For FortiADC versions 6.2.6 and below, disable the feature that allows read-only admins to view sensitive system information until a fix is available.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

BDU:2024-03861

CVE-2023-50180

Affected Products

Fortiadc

References · 6

• https://fortiguard.com/psirt/FG-IR-23-433 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50180 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50180 · Security Note
• https://bdu.fstec.ru/vul/2024-03861 · Security Note
• https://t.me/cvenotify/80871 · Telegram Post
• https://t.me/cvenotify/79754 · Telegram Post