CVE-2023-27998

Published: Sep 13, 2023Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.

Affected (5)

Products: Fortinet: Fortipresence

Fortinet

1 product

Fortipresence

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortipresence	Version 1.0.0
Fortinet Fortipresence	Version 1.1.0
Fortinet Fortipresence	Version 1.1.1
Fortinet Fortipresence	Version 1.2.0
Fortinet Fortipresence	Version 1.2.1

Related CWEs

CWE-755

Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

CWE-756

Missing Custom Error Page

The product does not return custom error pages to the user, possibly exposing sensitive information.

References (2)

https://fortiguard.com/psirt/FG-IR-22-288

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-288

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.