CVE-2023-40723: Exposure of Sensitive Information to an Unauthorized Actor
An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1 and 6.4.0 through 6.4.2 and 6.3.0 through 6.3.3 and 6.2.0 through 6.2.1 and 6.1.0 through 6.1.2 and 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 allows attacker to execute unauthorized code or commands via api request.
Other sources
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiSIEM may allow a remote unauthenticated attacker who acquired knowledge of the agent's authorization header by other means to read the database password via crafted api requests
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40723?
CVE-2023-40723 is rated as a medium severity vulnerability due to exposure of sensitive information.
How do I fix CVE-2023-40723?
To fix CVE-2023-40723, you should upgrade Fortinet FortiSIEM to the latest patched version.
What versions of Fortinet FortiSIEM are affected by CVE-2023-40723?
CVE-2023-40723 affects Fortinet FortiSIEM versions from 5.2.5 to 6.7.4 inclusive.
What type of vulnerability is CVE-2023-40723?
CVE-2023-40723 is an exposure of sensitive information vulnerability.
Can CVE-2023-40723 be exploited remotely?
Yes, CVE-2023-40723 can potentially be exploited by unauthorized actors remotely.