{"id":"CVE-2023-26208","state":"PUBLISHED","title":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows  a remote unauthenticated attacker to par","description":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.","publishedAt":"2023-03-09T14:55:08.396Z","updatedAt":"2024-10-22T20:47:53.846Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiAuthenticator"],"affected":[{"vendor":"Fortinet","product":"FortiAuthenticator","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.6","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.1","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.7","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-20-078"],"weaknesses":["CWE-307"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/26xxx/CVE-2023-26208.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-26208","state":"PUBLISHED","datePublished":"2023-03-09T14:55:08.396Z","dateUpdated":"2024-10-22T20:47:53.846Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-02-20T15:09:20.636Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form."}],"affected":[{"vendor":"Fortinet","product":"FortiAuthenticator","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.6","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.1","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.7","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-078","name":"https://fortiguard.com/psirt/FG-IR-20-078"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-307","lang":"en","description":"Denial of service","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-03-09T14:55:08.396Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiAuthenticator version 6.5.0 or above,\nPlease upgrade to FortiDeceptor version 3.2.0 or above.\nPlease upgrade to FortiMail version 6.4.1 or above,\r\nPlease upgrade to FortiMail version 6.2.5 or above,\r\nPlease upgrade to FortiMail version 6.0.10 or above."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-20-078","name":"https://fortiguard.com/psirt/FG-IR-20-078","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:46:23.306Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-22T20:18:20.330286Z","id":"CVE-2023-26208","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T20:47:53.846Z"}}]}}}