CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2023-42791
https://notcve.org/view.php?id=CVE-2023-42791
A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests. Un path traversal relativo en Fortinet FortiManager versión 7.4.0 y 7.2.0 a 7.2.3 y 7.0.0 a 7.0.8 y 6.4.0 a 6.4.12 y 6.2.0 a 6.2.11 permite al atacante ejecutar código no autorizado o comandos a través de solicitudes HTTP manipuladas. • https://fortiguard.com/psirt/FG-IR-23-189 • CWE-23: Relative Path Traversal •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2023-44253
https://notcve.org/view.php?id=CVE-2023-44253
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests. Una exposición de información confidencial a una vulnerabilidad de actor no autorizado [CWE-200] en Fortinet FortiManager versión 7.4.0 a 7.4.1 y anteriores a 7.2.5, FortiAnalyzer versión 7.4.0 a 7.4.1 y anteriores a 7.2.5 y FortiAnalyzer-BigData Las versiones anteriores a 7.2.5 permiten a un administrador de adom enumerar otros adoms y nombres de dispositivos a través de solicitudes HTTP o HTTPS manipuladas. • https://fortiguard.com/psirt/FG-IR-23-268 https://github.com/orangecertcc/security-research/security/advisories/GHSA-25j8-69h7-83h2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-40719
https://notcve.org/view.php?id=CVE-2023-40719
A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testing data via the use of static credentials. Un uso de vulnerabilidad de credenciales codificadas en Fortinet FortiAnalyzer y FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 y 7.4.0 permite a un atacante acceder a datos de pruebas privados de Fortinet mediante el uso de credenciales estáticas. • https://fortiguard.com/psirt/FG-IR-23-177 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 1CVE-2023-44256
https://notcve.org/view.php?id=CVE-2023-44256
A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 and FortiManager version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 allows a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. Una vulnerabilidad de server-side request forgery [CWE-918] en Fortinet FortiAnalyzer versión 7.4.0, versión 7.2.0 a 7.2.3 y anteriores a 7.0.8 y FortiManager versión 7.4.0, versión 7.2.0 a 7.2.3 y anteriores 7.0.8 permite a un atacante remoto con privilegios bajos ver datos confidenciales de servidores internos o realizar un escaneo de puerto local a través de una solicitud HTTP manipulada. • https://fortiguard.com/psirt/FG-IR-19-039 https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.6EPSS: 0%CPEs: 7EXPL: 0CVE-2023-41679
https://notcve.org/view.php?id=CVE-2023-41679
An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs Una vulnerabilidad de control de acceso inadecuado [CWE-284] en la interfaz de administración de FortiManager 7.2.0 a 7.2.2, 7.0.0 a 7.0.7, 6.4.0 a 6.4.11, 6.2 todas las versiones, 6.0 todas las versiones puede permitir a un atacante remoto no autenticado con al menos permiso de "administración de dispositivos" en su perfil y perteneciente a un ADOM específico agregar y eliminar scripts CLI en otros ADOM. • https://fortiguard.com/psirt/FG-IR-23-062 • CWE-284: Improper Access Control •