Log in Start free

Vulnerability · Published Jun 13, 2023 · Assigned by fortinet

CVE-2023-26204

Low 3.6

In plain English

A low-severity security flaw in FortiSIEM from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI.

Affected products (as reported)

VendorProductVersions
Fortinet FortiSIEM 6.7.0 – through 6.7.56.6.0 – through 6.6.36.5.0 – through 6.5.16.4.0 – through 6.4.26.3.0 – through 6.3.36.2.0 – through 6.2.16.1.0 – through 6.1.25.4.0

Weakness: CWE-256 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C

References