FG-IR-23-103: Improper access control in backup and restore features
An improper access control vulnerability [CWE-284] in FortiWLM MEA for FortiManager may allow an unauthenticated remote attacker to execute arbitrary code or commands via specifically crafted requests.
Note that FortiWLM MEA is not installed by default on FortiManager and can be disabled as a workaround.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-103?
The severity of FG-IR-23-103 is high due to the potential for unauthenticated remote code execution.
How do I fix FG-IR-23-103?
To fix FG-IR-23-103, upgrade your FortiManager to at least version 7.4.1 or the appropriate remedial version for your current release.
Which versions of FortiManager are affected by FG-IR-23-103?
FG-IR-23-103 affects various versions of FortiManager, specifically prior to versions 7.4.1, 7.2.4, 7.0.11, and 6.4.14.
What type of vulnerability is FG-IR-23-103?
FG-IR-23-103 is classified as an improper access control vulnerability, allowing remote attackers to execute arbitrary code.
Can FG-IR-23-103 be exploited without authentication?
Yes, FG-IR-23-103 can be exploited by unauthenticated remote attackers through specially crafted requests.