This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 3 vulnerabilities

Fortinet fixes 3 vulnerabilities in FortiNAC, FortiManager, FortiAnalyzer, FortiAnalyzer-BigData and FortiClientEMS. Affected products and their fixed versions: FortiNAC - 9.4.4, 7.2.3 FortiAnalyzer - 7.4.2, 7.2.4 FortiAnalyzer-BigData - 7.2.6 FortiManager - 7.4.2, 7.2.4 FortiClientEMS - 7.2.3, 7.0.11

FortiNAC - XSS (CVE-2023-26206)
CVSS 6.1 (Medium)

An authenticated remote attacker with site administrator privileges can perform operations with global administrator privileges [1].

The vulnerability is present in product:

  • FortiNAC; ==0; <7.2.2, >=7.2.0; <8.4.0, >=8.3.0; <8.9.0, >=8.5.0; <9.3.0, >=9.1.0; <9.4.3, >=9.4.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 13. 2. 2024.

Forti* - information exposure (CVE-2023-44253)
CVSS 5.0 (Medium)

An authenticated remote attacker with domain administrator privileges can gain unauthorized access to sensitive information [2].

The vulnerability is present in products:

  • FortiAnalyzer; ==0; <7.4.2, >=7.4.0; <7.2.4, >=7.2.0; <7.1.0, >=7.0.0; <6.5.0, >=6.4.0; <6.3.0, >=6.2.0
  • FortiAnalyzer-BigData; ==0; <7.2.6, >=7.2.0; <7.1.0, >=7.0.0; <6.5.0, >=6.4.0; <6.3.0, >=6.2.0
  • FortiManager; ==0; <7.4.2, >=7.4.0; <7.2.4, >=7.2.0; <7.1.0, >=7.0.0; <6.5.0, >=6.4.0; <6.3.0, >=6.2.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 8. 2. 2024.

FortiClientEMS - improper privilege mngmnt (CVE-2023-45581)
CVSS 8.8 (High)

An unauthenticated remote attacker can carry out a stored XSS attack [3].

The vulnerability is present in product:

  • FortiClientEMS; ==0; <7.2.3, >=7.2.0; <7.0.11, >=7.0.0, !=7.0.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:U

More information:

The vulnerability was publicly disclosed 8. 2. 2024.

By CESNET, z.s.p.o. Martin Krajči on 20. 2. 2024.

CESNET, z.s.p.o. Logo