FG-IR-23-103: Improper access control in backup and restore features
First published: Tue Mar 12 2024(Updated: )
An improper access control vulnerability [`CWE-284]` in FortiWLM MEA for FortiManager may allow an unauthenticated remote attacker to execute arbitrary code or commands via specifically crafted requests. Note that FortiWLM MEA is not installed by default on FortiManager and can be disabled as a workaround.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiManager | ||
| Fortinet FortiManager | ||
| Fortinet FortiManager | =. | |
| Fortinet FortiManager | >=7.2.0<=7.2.3 | |
| Fortinet FortiManager | >=7.0.0<=7.0.10 | |
| Fortinet FortiManager | >=6.4.0<=6.4.13 | |
| Fortinet FortiManager | >=6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of FG-IR-23-103?
The severity of FG-IR-23-103 is high due to the potential for unauthenticated remote code execution.
How do I fix FG-IR-23-103?
To fix FG-IR-23-103, upgrade your FortiManager to at least version 7.4.1 or the appropriate remedial version for your current release.
Which versions of FortiManager are affected by FG-IR-23-103?
FG-IR-23-103 affects various versions of FortiManager, specifically prior to versions 7.4.1, 7.2.4, 7.0.11, and 6.4.14.
What type of vulnerability is FG-IR-23-103?
FG-IR-23-103 is classified as an improper access control vulnerability, allowing remote attackers to execute arbitrary code.
Can FG-IR-23-103 be exploited without authentication?
Yes, FG-IR-23-103 can be exploited by unauthenticated remote attackers through specially crafted requests.
- agent/type
- agent/severity
- agent/title
- agent/references
- agent/first-publish-date
- agent/trending
- agent/source
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2023-36554
- agent/last-modified-date
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/fortiguard-psirt
- vendor/fortinet
- canonical/fortinet fortimanager
- version/fortinet fortimanager/.
- version/fortinet fortimanager/7.2.0
- version/fortinet fortimanager/7.2.3
- version/fortinet fortimanager/7.0.0
- version/fortinet fortimanager/7.0.10
- version/fortinet fortimanager/6.4.0
- version/fortinet fortimanager/6.4.13
- version/fortinet fortimanager/6.2