CVE-2023-26207 : An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy

An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.

Published 2023-06-13 09:15:16

Updated 2023-06-16 19:41:19

Source Fortinet, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-26207

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-26207

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	Fortinet, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-26207

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2023-26207

Fortinet » Fortios
Versions from including (>=) 7.2.0 and up to, including, (<=) 7.2.4
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.10
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy » Version: 7.2.0
cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy » Version: 7.2.1
cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2023-26207

Exploit prediction scoring system (EPSS) score for CVE-2023-26207

CVSS scores for CVE-2023-26207

CWE ids for CVE-2023-26207

References for CVE-2023-26207

Products affected by CVE-2023-26207