Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2023-42787

A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 m

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiAnalyzer

Default version status: unaffected

  • 7.4.0affected
  • 7.2.0 to ≤ 7.2.3affected
  • 7.0.0 to ≤ 7.0.9affected
  • 6.4.0 to ≤ 6.4.15affected
  • 6.2.0 to ≤ 6.2.13affected

Fortinet FortiManager

Default version status: unaffected

  • 7.4.0affected
  • 7.2.0 to ≤ 7.2.3affected
  • 7.0.0 to ≤ 7.0.9affected
  • 6.4.0 to ≤ 6.4.15affected
  • 6.2.0 to ≤ 6.2.13affected

Fortinet FortiAnalyzer-BigData

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.5affected
  • 7.0.1 to ≤ 7.0.6affected
  • 6.4.5 to ≤ 6.4.7affected
  • 6.2.5affected

Fortinet FortiAnalyzer Cloud

Default version status: unaffected

  • 7.0.1 to ≤ 7.0.9affected

References