CVE-2023-41673

CWE-2854 documents4 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 63.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Fortinet Fortiadc

Timeline

PublishedDec 13

Description

An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.2

Affected Packages2 packages

▶CVEListV5fortinet/fortiadc7.2.0 — 7.2.2+6

▶NVDfortinet/fortiadc6.0.0 — 6.0.4+8

🔴Vulnerability Details

GHSA

GHSA-59fj-qghq-2hgp: An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7↗2023-12-13

▶

CVEList

CVE-2023-41673: An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7↗2023-12-13

▶

📋Vendor Advisories

Fortinet

An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low pr...↗2023-12-13

▶