CVE-2023-25609 | ByteOS Network

Vulnerability Details :

CVE-2023-25609

Assigner-fortinet

Assigner Org ID-6abe59d8-c742-4dff-8ce8-9b0ca1073da8

Published At-13 Jun, 2023 | 08:41

Updated At-22 Oct, 2024 | 20:45

A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:fortinet

Assigner Org ID:6abe59d8-c742-4dff-8ce8-9b0ca1073da8

Published At:13 Jun, 2023 | 08:41

Updated At:22 Oct, 2024 | 20:45

▼CVE Numbering Authority (CNA)

A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.

Affected Products

Vendor

Product

Default Status

unaffected

Versions

Affected

From 7.2.0 through 7.2.1 (semver)
From 7.0.0 through 7.0.6 (semver)
From 6.4.8 through 6.4.11 (semver)

Vendor

Product

Default Status

unaffected

Versions

Affected

From 7.2.0 through 7.2.1 (semver)
From 7.0.0 through 7.0.6 (semver)
From 6.4.8 through 6.4.11 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-918	Information disclosure

Type: CWE

CWE ID: CWE-918

Description: Information disclosure

Metrics

Version	Base score	Base severity	Vector
3.1	4.2	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C

Version: 3.1

Base score: 4.2

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C

Solutions

Please upgrade to FortiAnalyzer version 7.2.2 or above Please upgrade to FortiAnalyzer version 7.0.7 or above Please upgrade to FortiAnalyzer version 6.4.12 or above Please upgrade to FortiManager version 7.2.2 or above Please upgrade to FortiManager version 7.0.7 or above Please upgrade to FortiManager version 6.4.12 or above

References

Hyperlink	Resource
https://fortiguard.com/psirt/FG-IR-22-493	N/A

Hyperlink: https://fortiguard.com/psirt/FG-IR-22-493

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://fortiguard.com/psirt/FG-IR-22-493	x_transferred

Hyperlink: https://fortiguard.com/psirt/FG-IR-22-493

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:psirt@fortinet.com

Published At:13 Jun, 2023 | 09:15

Updated At:07 Nov, 2023 | 04:09

A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CPE Matches

>>fortianalyzer>>Versions from 6.4.8(inclusive) to 6.4.11(inclusive)

cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*

>>fortianalyzer>>Versions from 7.0.0(inclusive) to 7.0.6(inclusive)

cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*

>>fortianalyzer>>7.2.0

cpe:2.3:a:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*

>>fortianalyzer>>7.2.1

cpe:2.3:a:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*

>>fortimanager>>Versions from 6.4.8(inclusive) to 6.4.11(inclusive)

cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*

>>fortimanager>>Versions from 7.0.0(inclusive) to 7.0.6(inclusive)

cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*

>>fortimanager>>7.2.0

cpe:2.3:a:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*

>>fortimanager>>7.2.1

cpe:2.3:a:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	nvd@nist.gov
CWE-918	Secondary	psirt@fortinet.com

CWE ID: CWE-918

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-918

Type: Secondary

Source: psirt@fortinet.com

References

Hyperlink	Source	Resource
https://fortiguard.com/psirt/FG-IR-22-493	psirt@fortinet.com	Vendor Advisory

Hyperlink: https://fortiguard.com/psirt/FG-IR-22-493

Source: psirt@fortinet.com

Resource:

Vendor Advisory