CVE-2023-44249: An authorization bypass through user-controlled key [CWE-639] vulnerability

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3

Status

Published

2023-10-10

Updated

2025-02-13

Assigning organization

fortinet

Description

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiManager

Default version status: unaffected

7.4.0affected
7.2.0 to ≤ 7.2.3affected
7.0.0 to ≤ 7.0.9affected
6.4.0 to ≤ 6.4.13affected
6.2.0 to ≤ 6.2.12affected

Fortinet FortiAnalyzer