Authorization Bypass Vulnerability in FortiVoice Enterprise

CVE-2023-40720

Summary

An authorization bypass vulnerability exists in FortiVoice Enterprise versions 7.0.0 and 7.0.1, as well as all versions prior to 6.4.8. This flaw permits authenticated attackers to exploit vulnerabilities in user-controlled keys, thereby allowing unauthorized access to the SIP configuration of other users. By crafting specific HTTP or HTTPS requests, the security of affected systems can be compromised, potentially leading to data exposure that could have severe implications for user privacy and system integrity.

References