FG-IR-23-201: Authorization bypass via key value controlled by user

Published Oct 10, 2023

Updated

An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiManager & FortiAnalyzer may allow a remote attacker with low privileges to read sensitive information via crafted HTTP requests.

Affected Software

7 affected componentsFixes available

Fortinet FortiAnalyzer-BigData=.

Fortinet FortiAnalyzer-BigData>=7.2.0<=7.2.5

Fortinet FortiManager=.

Fortinet FortiManager>=7.2.0<=7.2.3

Fortinet FortiManager>=7.0.0<=7.0.9

Fortinet FortiManager>=6.4

Fortinet FortiManager>=6.2

Event History

Oct 10, 2023

Advisory Published

via FortiGuard·12:00 AM

Jan 15, 2025

Advisory Published

via FortiGuard·09:26 AM

Frequently Asked Questions

What is the severity of FG-IR-23-201?

FG-IR-23-201 is considered a serious authorization bypass vulnerability allowing low-privileged attackers to access sensitive information.

How do I fix FG-IR-23-201?

Fix FG-IR-23-201 by updating FortiManager and FortiAnalyzer to the latest remedied versions as specified in the advisory.

Which versions are affected by FG-IR-23-201?

FG-IR-23-201 affects various versions of FortiManager and FortiAnalyzer, specifically prior to the remedied versions mentioned in the advisory.

Can FG-IR-23-201 be exploited remotely?

Yes, FG-IR-23-201 allows a remote attacker to exploit the vulnerability through crafted HTTP requests.

What type of vulnerability is FG-IR-23-201?

FG-IR-23-201 is classified as an authorization bypass vulnerability identified by CWE-639.