FortiManager Vulnerability Allows Adom Administrator to Enumerate Other Adoms and Device Names

CVE-2023-44253

Summary

An exposure of sensitive information vulnerability exists in Fortinet's FortiManager and FortiAnalyzer, where adom administrators can enumerate other administrative domains and device names via specially crafted HTTP or HTTPS requests. This vulnerability affects FortiManager versions 7.4.0 through 7.4.1 and prior versions below 7.2.5, as well as FortiAnalyzer and FortiAnalyzer-BigData in the same version range. Malicious actors could exploit this issue to gain insights into the operational environment and potentially facilitate further attacks.

References