CVE-2023-42782

Published: Oct 10, 2023Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number.

Affected (5)

Products: Fortinet: Fortianalyzer

Fortinet

1 product

Fortianalyzer

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.2.0 to 6.2.12
Fortinet Fortianalyzer	From 6.4.0 to 6.4.13
Fortinet Fortianalyzer	From 7.0.0 to 7.0.9
Fortinet Fortianalyzer	From 7.2.0 to 7.2.3
Fortinet Fortianalyzer	Version 7.4.0

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

https://fortiguard.com/psirt/FG-IR-23-221

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-221

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.