VYPR
← All advisories
Medium severity5.0NVD Advisory· Published Sep 10, 2024· Updated Jun 17, 2026

CVE-2023-44254

CVE-2023-44254

Description

An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request.

Affected products

9
  • Fortinet/Fortianalyzer4 versions
    cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*range: >=6.2.0,<7.2.5
    • cpe:2.3:a:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*range: 7.4.0
    • (no CPE)range: <7.2.5, <=7.4.1
  • Fortinet/Fortianalyzer Big Data
    cpe:2.3:a:fortinet:fortianalyzer_big_data:*:*:*:*:*:*:*:*
    Range: >=7.2.0,<=7.2.5
  • Fortinet/Fortimanager4 versions
    cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*range: >=6.2.0,<7.2.5
    • cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*range: 7.4.0
    • (no CPE)range: <7.2.5, <=7.4.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.