CVE-2023-26205

Published: Nov 14, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script.

Affected (6)

Products: Fortinet: Fortiadc

Fortinet

1 product

Fortiadc

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiadc	From 6.1.0 to 6.1.6
Fortinet Fortiadc	From 6.2.0 to 6.2.6
Fortinet Fortiadc	From 7.0.0 to 7.0.5
Fortinet Fortiadc	Version 7.1.0
Fortinet Fortiadc	Version 7.1.1
Fortinet Fortiadc	Version 7.1.2

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://fortiguard.com/psirt/FG-IR-22-292

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-292

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.