CVE-2023-44255

Published: Nov 12, 2024Modified: Jan 21, 2025

4.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Exploitability: 2.3 / Impact: 1.4

Source: NVD

Description

An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP or HTTPs requests.

Affected (3)

Products: Fortinet: Fortianalyzer, Fortianalyzer Big Data, Fortimanager

3 products

Fortianalyzer Big Data

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.2.0 to 7.4.3
Fortinet Fortianalyzer Big Data	From 6.2.1 to 7.2.6
Fortinet Fortimanager	From 6.2.0 to 7.4.3

Related CWEs

Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-23-267

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.