CVE-2023-36635: High severity fortinet fortiswitchmanager vulnerability
Published Sep 7, 2023
·Updated
An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.
Affected Software
5 affected components
Fortinet FortiSwitchManager=7.0.0
Fortinet FortiSwitchManager=7.0.1
Fortinet FortiSwitchManager=7.2.0
Fortinet FortiSwitchManager=7.2.1
Fortinet FortiSwitchManager=7.2.2
Remediation
Information
Please upgrade to FortiOS version 7.2.1 or above
Please upgrade to FortiOS version 7.0.8 or above
Please upgrade to FortiSwitchManager version 7.2.2 or above
Please upgrade to FortiSwitchManager version 7.0.2 or above
Event History
Sep 7, 2023
CVE Published
via MITRE·12:41 PM
Data Sourced
via MITRE·12:41 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-36635.
2
What is the severity of CVE-2023-36635?
The severity of CVE-2023-36635 is high (4.3).
3
Which versions of Fortinet FortiSwitchManager are affected by CVE-2023-36635?
Fortinet FortiSwitchManager versions 7.0.0, 7.0.1, 7.2.0, 7.2.1, and 7.2.2 are affected by CVE-2023-36635.
4
What is the impact of CVE-2023-36635?
CVE-2023-36635 may allow a remote authenticated read-only user to modify the interface settings via the API.
5
Is there any additional information available about CVE-2023-36635?
Yes, you can find additional information about CVE-2023-36635 on the FortiGuard PSIRT website: https://fortiguard.com/psirt/FG-IR-22-174