CVE-2023-44250: Improper authorization for HA requests
An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.
Other sources
An improper privilege management vulnerability [CWE-269] in a FortiOS & FortiProxy HA cluster may allow an authenticated attacker to perform elevated actions over the web administrative interface via crafted HTTP or HTTPS requests.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-44250?
The severity of CVE-2023-44250 is categorized as a high-risk vulnerability due to its potential for privilege escalation by authenticated users.
How do I fix CVE-2023-44250?
To fix CVE-2023-44250, upgrade FortiOS to version 7.4.2 or later, or FortiProxy to version 7.4.2 or later.
Which versions of FortiOS are affected by CVE-2023-44250?
FortiOS versions 7.4.0, 7.4.1, and 7.2.5 are affected by CVE-2023-44250.
Is CVE-2023-44250 a remote or local vulnerability?
CVE-2023-44250 is a local vulnerability as it requires authenticated access to exploit.
What types of actions can an attacker perform due to CVE-2023-44250?
An attacker can perform elevated actions on Fortinet FortiOS and FortiProxy systems through crafted HTTP or HTTPS requests.