CVE-2023-46717

published 2024-03-12

CVE-2023-46717: An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured…

Priority P2 60 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive login attempts.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortiauthenticator	—	—
fortinet	fortios	—	—
fortinet	fortios	>= 7.0.0 < 7.0.13	7.0.13
fortinet	fortios	7.0.0 – 7.0.12	—
fortinet	fortios	>= 7.2.0 < 7.2.7	7.2.7
fortinet	fortios	7.2.0 – 7.2.6	—
fortinet	fortios	>= 7.4.0 < 7.4.2	7.4.2
fortinet	fortios	7.4.0 – 7.4.1	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for successive login attempts by read-only users against FortiOS systems configured with FortiAuthenticator in HA mode, which may indicate exploitation of improper authentication to escalate to read-write access. ↗

• · The vulnerability is only exploitable when FortiOS is configured with FortiAuthenticator in High Availability (HA) mode. Systems not using this specific configuration are not affected. ↗
• · Affected FortiOS versions are 7.4.1 and below, 7.2.6 and below, and 7.0.12 and below. Patching to versions beyond these thresholds is required to remediate. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287