{"id":"CVE-2023-40714","state":"PUBLISHED","title":"A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain G","description":"A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements","publishedAt":"2025-04-02T08:06:48.075Z","updatedAt":"2025-04-02T16:16:37.645Z","severity":{"score":9.7,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiSIEM"],"affected":[{"vendor":"Fortinet","product":"FortiSIEM","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected"},{"version":"6.7.0","status":"affected","lessThanOrEqual":"6.7.2","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThanOrEqual":"6.6.3","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThanOrEqual":"6.5.1","versionType":"semver"}],"cpes":[]}],"references":["https://fortiguard.com/psirt/FG-IR-23-085"],"weaknesses":["CWE-23"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/40xxx/CVE-2023-40714.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-40714","state":"PUBLISHED","datePublished":"2025-04-02T08:06:48.075Z","dateUpdated":"2025-04-02T16:16:37.645Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-08-21T09:03:44.315Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements"}],"affected":[{"vendor":"Fortinet","product":"FortiSIEM","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected"},{"version":"6.7.0","status":"affected","lessThanOrEqual":"6.7.2","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThanOrEqual":"6.6.3","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThanOrEqual":"6.5.1","versionType":"semver"}],"cpes":[]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-085","name":"https://fortiguard.com/psirt/FG-IR-23-085"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.7,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","lang":"en","description":"Escalation of privilege","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2025-04-02T08:06:48.075Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiSIEM version 7.0.1 or above\nPlease upgrade to FortiSIEM version 6.7.4 or above\nPlease upgrade to FortiSIEM version 6.6.4 or above\nPlease upgrade to FortiSIEM version 6.5.2 or above\nPlease upgrade to FortiSIEM version 6.4.3 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-02T16:14:52.268463Z","id":"CVE-2023-40714","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-02T16:16:37.645Z"}}]}}}