CVE-2023-41677: Administrator cookie leakage

Published Apr 9, 2024

Updated

A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via targeted social engineering attack

Other sources

An insufficiently protected credentials vulnerability (CWE-522) in FortiOS and FortiProxy may allow an attacker to obtain the administrator cookie in rare and specific conditions, via tricking the administrator into visiting a malicious attacker-controlled website through the SSL-VPN.

— FortiGuard

Affected Software

21 affected componentsFixes available

Fortinet FortiProxy>=1.0.0<7.0.14

Fortinet FortiProxy>=7.2.0<7.2.8

Fortinet FortiProxy>=7.4.0<7.4.2

Fortinet FortiOS>=6.0.0<6.2.16

Fortinet FortiOS>=6.4.0<6.4.15

Fortinet FortiOS>=7.0.0<7.0.13

Fortinet FortiOS>=7.2.0<7.2.7

Fortinet FortiOS>=7.4.0<7.4.2

Fortinet FortiOS>=7.4.0<=7.4.1

Fortinet FortiOS>=7.2.0<=7.2.6

Fortinet FortiOS>=7.0.0<=7.0.12

Fortinet FortiOS>=6.4.0<=6.4.14

Fortinet FortiOS>=6.2.0<=6.2.15

Fortinet FortiOS>=6.0

Fortinet FortiProxy>=7.4.0<=7.4.1

Fortinet FortiProxy>=7.2.0<=7.2.7

Fortinet FortiProxy>=7.0.0<=7.0.13

Fortinet FortiProxy>=2.0

Fortinet FortiProxy>=1.2

Fortinet FortiProxy>=1.1

Fortinet FortiProxy>=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 6.2.16
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 6.4.15
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.0.13
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.2.7
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.4.2
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.0.14
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.2.8
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.4.2

Event History

Apr 9, 2024

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Apr 10, 2024

News Published

via The Register·12:15 AM

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-41677?

CVE-2023-41677 has been classified as a critical vulnerability due to insufficiently protected credentials.

How do I fix CVE-2023-41677?

To fix CVE-2023-41677, upgrade FortiOS to version 7.4.2 or later, 7.2.7 or later, or 7.0.13 or later.

Which versions are affected by CVE-2023-41677?

CVE-2023-41677 affects FortiOS versions from 7.4.0 to 7.4.1, 7.2.0 to 7.2.6, and 7.0.0 to 7.0.12, among others.

Is FortiProxy impacted by CVE-2023-41677?

Yes, CVE-2023-41677 also affects multiple versions of FortiProxy, specifically versions from 7.4.0 to 7.4.1, 7.2.0 to 7.2.7, and others.

What are the potential risks of CVE-2023-41677?

The potential risks of CVE-2023-41677 include unauthorized access and compromise of sensitive information due to insufficient protection of credentials.