Output Neutralization Vulnerability in Fortinet FortiWeb Products
CVE-2023-46713

4.9MEDIUM

Key Information:

Vendor
Fortinet
Status
FortiWeb
Vendor
CVE Published:
13 December 2023

Summary

An improper output neutralization vulnerability in Fortinet FortiWeb products could potentially allow an attacker to manipulate traffic logs. By crafting a specific URL, the attacker can forge entries within the log files, leading to potential misrepresentation of web application activity. This weakness affects multiple versions of the FortiWeb product, emphasizing the need for immediate monitoring and patching to safeguard against unauthorized logging manipulation.

Affected Version(s)

FortiWeb 7.4.0

FortiWeb 7.2.0 <= 7.2.5

FortiWeb 7.0.0 <= 7.0.10

References

https://fortiguard.com/psirt/FG-IR-23-256

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.