CVE-2023-41676

CWE-200 — Information ExposureCWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 44.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortisiem
Timeline
PublishedNov 14

Description

An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker with access to windows agent logs to obtain the windows agent password via searching through the logs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5fortinet/fortisiem6.7.0 — 6.7.5+1
▶NVDfortinet/fortisiem6.7.0 — 6.7.5+1

🔴Vulnerability Details

2
GHSA
GHSA-c5g2-f738-9q44: An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7↗2023-11-14
▶
CVEList
CVE-2023-41676: An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7↗2023-11-14
▶

📋Vendor Advisories

1
Fortinet
An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may...↗2023-11-14
▶
CVE-2023-41676 (MEDIUM CVSS 6.5) | An exposure of sensitive informatio | cvebase.io