CVE-2023-44253

CVE Database · CVE-2023-44253

CVE-2023-44253

· MEDIUMModified

CVSS v3.1

5.0

EPSS

0.68%

Published

Feb 15, 2024

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

Affected Products (12)

fortinet · fortianalyzervulnerable

fortinet · fortimanagervulnerable

References (4)

https://fortiguard.com/psirt/FG-IR-23-268

Vendor Advisory

https://github.com/orangecertcc/security-research/security/advisories/GHSA-25j8-69h7-83h2

https://fortiguard.com/psirt/FG-IR-23-268

Vendor Advisory

https://github.com/orangecertcc/security-research/security/advisories/GHSA-25j8-69h7-83h2

KEV Catalog EPSS Scores Vendors All CVEs