FortiManager Vulnerability Allows Adom Administrator to Enumerate Other Adoms and Device Names

CVE-2023-44253
4.7MEDIUM

Key Information

Vendor
Fortinet
Status
Fortimanager
Fortianalyzer
Vendor
CVE Published:
15 February 2024

Summary

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.

Affected Version(s)

FortiManager <= 7.4.1

FortiManager <= 7.2.3

FortiManager <= 7.0.11

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Risk change from: 5 to: 4.7 - (MEDIUM)

  • Risk change from: 5 to: 4.7 - (MEDIUM)

  • Risk change from: 4.7 to: 5 - (MEDIUM)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.