CVE-2023-45581

State: Published
Severity: 7.9 High
Published: Feb 15, 2024
Updated: Oct 22, 2026
Reserved: Oct 9, 2023

Description

An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.

Scores

CVSS	Score	Vector	Source
3.1	7.9 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:U	fortinet

Weaknesses

CWE-269 Execute unauthorized code or commands

Affected Products

Product	Versions
FortiClientEMSFortinet	7.2.0 through 7.2.2Affected 7.0.6 through 7.0.10Affected 7.0.0 through 7.0.4Affected 6.4.7 through 6.4.9Affected 6.4.0 through 6.4.4Affected 6.2.6 through 6.2.9Affected 6.2.3 through 6.2.4Affected 06.02.00 through 06.02.02Affected

References

https://fortiguard.com/psirt/FG-IR-23-357

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.