{"id":"CVE-2023-40719","state":"PUBLISHED","title":"A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testin","description":"A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testing data via the use of static credentials.","publishedAt":"2023-11-14T18:08:08.383Z","updatedAt":"2024-08-30T18:08:00.074Z","severity":{"score":4.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiAnalyzer","Fortinet FortiManager"],"affected":[{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-177"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/40xxx/CVE-2023-40719.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-40719","state":"PUBLISHED","datePublished":"2023-11-14T18:08:08.383Z","dateUpdated":"2024-08-30T18:08:00.074Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-08-21T09:03:44.315Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testing data via the use of static credentials."}],"affected":[{"vendor":"Fortinet","product":"FortiAnalyzer","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiManager","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.3","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.10","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-177","name":"https://fortiguard.com/psirt/FG-IR-23-177"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-11-14T18:08:08.383Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiAnalyzer version 7.4.1 or above \nPlease upgrade to FortiAnalyzer version 7.2.4 or above \nPlease upgrade to FortiManager version 7.4.1 or above \nPlease upgrade to FortiManager version 7.2.4 or above \n"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-177","name":"https://fortiguard.com/psirt/FG-IR-23-177","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T18:38:51.275Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-30T18:07:40.374088Z","id":"CVE-2023-40719","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-30T18:08:00.074Z"}}]}}}