CVE-2023-44249

Published: Oct 10, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests.

Affected (10)

Products: Fortinet: Fortianalyzer, Fortimanager

Fortinet

2 products

Fortianalyzer

Fortimanager

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	6.2.0 ≤ version ≤ 6.2.12
Fortinet Fortianalyzer	6.4.0 ≤ version ≤ 6.4.13
Fortinet Fortianalyzer	7.0.0 ≤ version ≤ 7.0.9
Fortinet Fortianalyzer	7.2.0 ≤ version < 7.2.4
Fortinet Fortianalyzer	Version 7.4.0
Fortinet Fortimanager	6.2.0 ≤ version ≤ 6.2.12
Fortinet Fortimanager	6.4.0 ≤ version ≤ 6.4.13
Fortinet Fortimanager	7.0.0 ≤ version ≤ 7.0.9
Fortinet Fortimanager	7.2.0 ≤ version < 7.2.4
Fortinet Fortimanager	Version 7.4.0