FG-IR-23-268: Informative error messages
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData may allow an adom administrator to enumerate other adoms and device names via crafted HTTP or HTTPS requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-268?
The severity of FG-IR-23-268 is classified as an exposure of sensitive information vulnerability.
How do I fix FG-IR-23-268?
To fix FG-IR-23-268, upgrade FortiManager or FortiAnalyzer to the appropriate patched version specified in the vendor's advisory.
Which products are affected by FG-IR-23-268?
FG-IR-23-268 affects FortiManager and FortiAnalyzer versions prior to the specified remediation versions.
Can FG-IR-23-268 lead to data breaches?
Yes, FG-IR-23-268 can allow unauthorized actors to enumerate sensitive information, leading potentially to data breaches.
What is the cause of FG-IR-23-268?
FG-IR-23-268 is caused by crafted HTTP or HTTPS requests that exploit the vulnerability in the affected products.