Vulnerability · Published Oct 10, 2023 · Assigned by fortinet
CVE-2023-41679
High 7.7
In plain English
A high-severity improper access control in FortiManager from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiManager | 7.2.0 – through 7.2.27.0.0 – through 7.0.76.4.0 – through 6.4.116.2.0 – through 6.2.12 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R