medium5.0
CVE-2023-44254
An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and …
Impact
An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortianalyzer | from 6.2.0 before 7.2.5 Version 7.4.0 |
| Fortinet | Fortimanager | from 6.2.0 before 7.2.5 Version 7.4.0 |
| Fortinet | Fortianalyzer Big Data | from 7.2.0 through 7.2.5 |