VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Sep 13, 2023· Updated Jun 17, 2026

CVE-2023-36638

CVE-2023-36638

Description

An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.

Affected products

6
  • Fortinet/Fortianalyzer3 versions
    cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*range: >=6.0.0,<6.4.12
    • (no CPE)range: 7.2.0 - 7.2.2, 7.0.0 - 7.0.7, 6.4.0 - 6.4.11, 6.2.x, 6.0.x
    • (no CPE)range: 7.2.0
  • Fortinet/Fortimanager3 versions
    cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*range: >=6.4.0,<6.4.12
    • (no CPE)range: 7.2.0 - 7.2.2, 7.0.0 - 7.0.7, 6.4.0 - 6.4.11, 6.2.x, 6.0.x
    • (no CPE)range: 7.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.