{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2023-41677", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-08-30T13:42:39.547Z", "datePublished": "2024-04-09T14:24:21.614Z", "dateUpdated": "2024-08-02T19:01:35.404Z" }, "containers": { "cna": { "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.1", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.6", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.12", "status": "affected" }, { "versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.14", "status": "affected" }, { "versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.15", "status": "affected" }, { "versionType": "semver", "version": "6.0.0", "lessThanOrEqual": "6.0.18", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiProxy", "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.1", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.7", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.13", "status": "affected" }, { "versionType": "semver", "version": "2.0.0", "lessThanOrEqual": "2.0.14", "status": "affected" }, { "versionType": "semver", "version": "1.2.0", "lessThanOrEqual": "1.2.13", "status": "affected" }, { "versionType": "semver", "version": "1.1.0", "lessThanOrEqual": "1.1.6", "status": "affected" }, { "versionType": "semver", "version": "1.0.0", "lessThanOrEqual": "1.0.7", "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "value": "A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17 allows attacker to execute unauthorized code or commands via targeted social engineering attack" } ], "providerMetadata": { "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-04-15T08:10:53.751Z" }, "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-522", "description": "Execute unauthorized code or commands", "type": "CWE" } ] } ], "metrics": [ { "format": "CVSS", "cvssV3_1": { "version": "3.1", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C" } } ], "solutions": [ { "lang": "en", "value": "Please upgrade to FortiSASE version 23.4.a or above \nPlease upgrade to FortiOS version 7.4.2 or above \nPlease upgrade to FortiOS version 7.2.7 or above \nPlease upgrade to FortiOS version 7.0.13 or above \nPlease upgrade to FortiOS version 6.4.15 or above \nPlease upgrade to FortiOS version 6.2.16 or above \nPlease upgrade to FortiProxy version 7.4.2 or above \nPlease upgrade to FortiProxy version 7.2.8 or above \nPlease upgrade to FortiProxy version 7.0.14 or above \n" } ], "references": [ { "name": "https://fortiguard.com/psirt/FG-IR-23-493", "url": "https://fortiguard.com/psirt/FG-IR-23-493" } ] }, "adp": [ { "affected": [ { "vendor": "fortinet", "product": "fortios", "cpes": [ "cpe:2.3:a:fortinet:fortios:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "6.0.0", "status": "affected", "lessThanOrEqual": "6.0.18", "versionType": "custom" }, { "version": "6.2.0", "status": "affected", "lessThanOrEqual": "6.2.15", "versionType": "custom" }, { "version": "6.4.0", "status": "affected", "lessThanOrEqual": "6.4.14", "versionType": "custom" }, { "version": "7.0.0", "status": "affected", "lessThanOrEqual": "7.0.12", "versionType": "custom" }, { "version": "7.2.0", "status": "affected", "lessThanOrEqual": "7.2.6", "versionType": "custom" }, { "version": "7.4.0", "status": "affected", "lessThanOrEqual": "7.4.1", "versionType": "custom" } ] }, { "vendor": "fortinet", "product": "fortiproxy", "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "versions": [ { "version": "1.0.0", "status": "affected", "lessThanOrEqual": "1.0.7", "versionType": "custom" }, { "version": "1.1.0", "status": "affected", "lessThanOrEqual": "1.1.6", "versionType": "custom" }, { "version": "1.2.0", "status": "affected", "lessThanOrEqual": "1.2.13", "versionType": "custom" }, { "version": "2.0.0", "status": "affected", "lessThanOrEqual": "2.0.14", "versionType": "custom" }, { "version": "7.0.0", "status": "affected", "lessThanOrEqual": "7.0.13", "versionType": "custom" }, { "version": "7.2.0", "status": "affected", "lessThanOrEqual": "7.2.7", "versionType": "custom" }, { "version": "7.4.0", "status": "affected", "lessThanOrEqual": "7.4.1", "versionType": "custom" } ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-04-11T04:01:14.917820Z", "id": "CVE-2023-41677", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T15:15:27.451Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:01:35.404Z" }, "title": "CVE Program Container", "references": [ { "name": "https://fortiguard.com/psirt/FG-IR-23-493", "url": "https://fortiguard.com/psirt/FG-IR-23-493", "tags": [ "x_transferred" ] } ] } ] } }