{"id":"CVE-2023-36554","state":"PUBLISHED","title":"A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows a","description":"A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.","publishedAt":"2024-03-12T15:09:16.256Z","updatedAt":"2024-08-02T16:52:52.352Z","severity":{"score":7.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiManager"],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.13","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.12","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-103"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/36xxx/CVE-2023-36554.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-36554","state":"PUBLISHED","datePublished":"2024-03-12T15:09:16.256Z","dateUpdated":"2024-08-02T16:52:52.352Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-06-23T14:57:30.033Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests."}],"affected":[{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.13","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.12","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-103","name":"https://fortiguard.com/psirt/FG-IR-23-103"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-03-12T15:09:16.256Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiManager version 7.4.1 or above\r\nPlease upgrade to FortiManager version 7.2.4 or above\r\nPlease upgrade to FortiManager version 7.0.11 or above\r\nPlease upgrade to FortiManager version 6.4.14 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortinet","product":"fortimanager","defaultStatus":"unknown","versions":[{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.12","versionType":"custom"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.13","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"custom"}],"cpes":["cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortimanager","defaultStatus":"unknown","versions":[{"version":"7.4.0","status":"affected"}],"cpes":["cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-03-21T04:00:34.995809Z","id":"CVE-2023-36554","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-18T20:23:29.727Z"}},{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-103","name":"https://fortiguard.com/psirt/FG-IR-23-103","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:52:52.352Z"}}]}}}