Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-44256

A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request.

Published

2023-10-20T10:15:12.870

Last Modified

2024-11-21T08:25:31.910

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-22
Type: Primary
CWE-918

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	fortinet	fortianalyzer	≤ 6.4.13	Yes
Application	fortinet	fortianalyzer	≤ 7.0.8	Yes
Application	fortinet	fortianalyzer	≤ 7.2.3	Yes
Application	fortinet	fortianalyzer	7.4.0	Yes
Application	fortinet	fortimanager	≤ 7.0.8	Yes
Application	fortinet	fortimanager	≤ 7.2.3	Yes
Application	fortinet	fortimanager	7.4.0	Yes

References

https://fortiguard.com/psirt/FG-IR-19-039 Vendor Advisory ([email protected])
https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh Exploit, Third Party Advisory ([email protected])
https://fortiguard.com/psirt/FG-IR-19-039 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)