FortiManager Vulnerability Allows Adom Administrator to Enumerate Other Adoms and Device Names
CVE-2023-44253
4.7MEDIUM
What is CVE-2023-44253?
An exposure of sensitive information vulnerability exists in Fortinet's FortiManager and FortiAnalyzer, where adom administrators can enumerate other administrative domains and device names via specially crafted HTTP or HTTPS requests. This vulnerability affects FortiManager versions 7.4.0 through 7.4.1 and prior versions below 7.2.5, as well as FortiAnalyzer and FortiAnalyzer-BigData in the same version range. Malicious actors could exploit this issue to gain insights into the operational environment and potentially facilitate further attacks.
Affected Version(s)
FortiAnalyzer 7.4.0 <= 7.4.1
FortiAnalyzer 7.2.0 <= 7.2.3
FortiAnalyzer 7.0.0 <= 7.0.11