CVE-2023-45586

4.7MEDIUM

Key Information

Vendor
Fortinet
Status
Fortiproxy
FortiOS
Vendor
CVE Published:
14 May 2024

Summary

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

Affected Version(s)

FortiProxy <= 7.4.1

FortiProxy <= 7.2.7

FortiProxy <= 7.0.13

Refferences

https://fortiguard.com/psirt/FG-IR-23-225

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.