CVE-2023-23776

4.6MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortianalyzer
Vendor
CVE Published:
7 March 2023

Summary

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4 and 6.4.0 through 6.4.10 may allow a remote authenticated attacker to read the client machine password in plain text in a heartbeat response when a log-fetch request is made from the FortiAnalyzer

Affected Version(s)

FortiAnalyzer 7.2.0 <= 7.2.1

FortiAnalyzer 7.0.0 <= 7.0.4

FortiAnalyzer 6.4.0 <= 6.4.10

References

https://fortiguard.com/psirt/FG-IR-22-447

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.