CVE-2023-44255

State: Published
Severity: 3.9 Low
Published: Nov 12, 2024
Updated: Nov 13, 2024
Reserved: Sep 27, 2023

Description

An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP or HTTPs requests.

Scores

CVSS	Score	Vector	Source
3.1	3.9 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N/E:P/RL:X/RC:C	fortinet

Weaknesses

CWE-359 Information disclosure

Affected Products

Product	Versions
FortiManagerFortinet	7.4.0 through 7.4.2Affected 7.2.0 through 7.2.5Affected 7.0.0 through 7.0.13Affected 6.4.0 through 6.4.15Affected 6.2.0 through 6.2.13Affected
FortiAnalyzerFortinet	7.4.0 through 7.4.2Affected 7.2.0 through 7.2.3Affected 7.0.0 through 7.0.13Affected 6.4.0 through 6.4.15Affected 6.2.0 through 6.2.13Affected

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-267

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.