CVE-2023-42787 : A client-side enforcement of server-side security [CWE-602] vulnerability in Fo

A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.

Published 2023-10-10 17:15:13

Updated 2023-12-21 01:37:16

Source Fortinet, Inc.

View at NVD, CVE.org

Products affected by CVE-2023-42787

Fortinet » Fortimanager
Versions from including (>=) 6.2.0 and up to, including, (<=) 6.2.12
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimanager
Versions from including (>=) 7.2.0 and up to, including, (<=) 7.2.3
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimanager
Versions from including (>=) 6.4.0 and up to, including, (<=) 6.4.13
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimanager
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.9
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortimanager » Version: 7.4.0
cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortianalyzer
Versions from including (>=) 6.2.0 and up to, including, (<=) 6.2.12
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortianalyzer
Versions from including (>=) 6.4.0 and up to, including, (<=) 6.4.13
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortianalyzer
Versions from including (>=) 7.2.0 and up to, including, (<=) 7.2.3
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortianalyzer
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.0.9
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortianalyzer » Version: 7.4.0
cpe:2.3:a:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-42787

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 43 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-42787

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	Fortinet, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-42787

CWE-602 Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Assigned by: psirt@fortinet.com (Secondary)

References for CVE-2023-42787

https://fortiguard.com/psirt/FG-IR-23-187

PSIRT Advisories | FortiGuard
Vendor Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr

Fortinet FortiManager - CLI access (CVE-2023-42787) · Advisory · orangecertcc/security-research · GitHub
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-42787

Products affected by CVE-2023-42787

Exploit prediction scoring system (EPSS) score for CVE-2023-42787

CVSS scores for CVE-2023-42787

CWE ids for CVE-2023-42787

References for CVE-2023-42787