by Kastro
Paper/Archive/CVE-2023-41679

CVE-2023-41679

Fortinet FortiManager — An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 t…

EPSS 0.7%CVSS 9.6
critical.is priorityof 100
39
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 51.4.514 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs

Affected

ProductAffectedFixed inSource
FortiManager7.2.0 – 7.2.2–CNA
FortiManager7.0.0 – 7.0.7–CNA
FortiManager6.4.0 – 6.4.11–CNA
FortiManager6.2.0 – 6.2.12–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
fortinet (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-062