Permissive Cross-Domain Policy Vulnerability in Fortinet FortiADC and FortiDDoS
CVE-2023-25603

5.4MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortiddos-f
Fortiadc
Vendor
CVE Published:
14 November 2023

Summary

A permissive cross-domain policy vulnerability found in Fortinet FortiADC and FortiDDoS products exposes systems to significant security risks. This flaw allows unauthorized attackers to execute privileged actions and access sensitive information by exploiting untrusted domain permissions through specially crafted web requests. Organizations using the affected versions are advised to take immediate action to secure their systems by updating to the patched versions.

Affected Version(s)

FortiADC 7.1.0 <= 7.1.1

FortiDDoS-F 6.4.0 <= 6.4.1

FortiDDoS-F 6.3.0 <= 6.3.4

References

https://fortiguard.com/psirt/FG-IR-22-518

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.