Paper/Archive/CVE-2023-36554

CVE-2023-36554

Fortinet FortiManager — A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.…

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.5.555 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.

Affected

ProductAffectedFixed inSource

FortiManager7.4.0–CNA

FortiManager7.2.0 – 7.2.3–CNA

FortiManager7.0.0 – 7.0.10–CNA

FortiManager6.4.0 – 6.4.13–CNA

FortiManager6.2.0 – 6.2.12–CNA

fortimanager6.2.0 – 6.2.12–CISA-ADP

fortimanager6.4.0 – 6.4.13–CISA-ADP

fortimanager7.0.0 – 7.0.10–CISA-ADP

fortimanager7.2.0 – 7.2.3–CISA-ADP

fortimanager7.4.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-103