What is the severity of CVE-2023-37932?

CVE-2023-37932 has a high severity rating due to the potential for an authenticated attacker to exploit the vulnerability and access sensitive files.

What software versions are affected by CVE-2023-37932?

CVE-2023-37932 affects FortiVoice versions 7.0.0, 6.4.0 through 6.4.7, and 6.0.0 through 6.0.12.

How do I fix CVE-2023-37932?

To fix CVE-2023-37932, upgrade FortiVoice to version 6.4.8 or later, or to version 7.0.1 or later.

What type of attack does CVE-2023-37932 enable?

CVE-2023-37932 enables a path traversal attack, allowing attackers to read arbitrary files from the system.

Is authentication required to exploit CVE-2023-37932?

Yes, CVE-2023-37932 requires the attacker to be authenticated to the FortiVoice system to exploit the vulnerability.

Vulnerability/
CVE-2023-37932

medium

6.5

CWE

10/1/2024

2/8/2024

CVE-2023-37932: Path Traversal

First published: Wed Jan 10 2024(Updated: )

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests

Credit: psirt@fortinet.com

Affected Software	Affected Version	How to fix
Fortinet FortiVoice	>=6.0.0<=6.0.12
Fortinet FortiVoice	>=6.4.0<6.4.8
Fortinet FortiVoice	=7.0.0

Remedy

Please upgrade to FortiVoice version 7.0.1 or above Please upgrade to FortiVoice version 6.4.8 or above

Never miss a vulnerability like this again

Reference Links

https://fortiguard.com/psirt/FG-IR-23-219

Frequently Asked Questions

What is the severity of CVE-2023-37932?
CVE-2023-37932 has a high severity rating due to the potential for an authenticated attacker to exploit the vulnerability and access sensitive files.
What software versions are affected by CVE-2023-37932?
CVE-2023-37932 affects FortiVoice versions 7.0.0, 6.4.0 through 6.4.7, and 6.0.0 through 6.0.12.
How do I fix CVE-2023-37932?
To fix CVE-2023-37932, upgrade FortiVoice to version 6.4.8 or later, or to version 7.0.1 or later.
What type of attack does CVE-2023-37932 enable?
CVE-2023-37932 enables a path traversal attack, allowing attackers to read arbitrary files from the system.
Is authentication required to exploit CVE-2023-37932?
Yes, CVE-2023-37932 requires the attacker to be authenticated to the FortiVoice system to exploit the vulnerability.

agent/type
agent/weakness
agent/author
agent/references
agent/description
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/remedy
agent/severity
agent/first-publish-date
agent/event
agent/tags
agent/source
vendor/fortinet
canonical/fortinet fortivoice
version/fortinet fortivoice/6.0.0
version/fortinet fortivoice/6.0.12
version/fortinet fortivoice/6.4.0
version/fortinet fortivoice/7.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.