{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiClientEMS 6.2 toutes versions",
      "product": {
        "name": "FortiClientEMS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 6.4.x ant\u00e9rieures \u00e0 6.4.14",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.4.x ant\u00e9rieures \u00e0 7.4.3",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.14",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.15",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPortal versions 7.2.x ant\u00e9rieures \u00e0 7.2.1",
      "product": {
        "name": "FortiPortal",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientEMS 6.0 toutes versions",
      "product": {
        "name": "FortiClientEMS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer-BigData versions 7.2.x ant\u00e9rieures \u00e0 7.2.6",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientEMS 6.4 toutes versions",
      "product": {
        "name": "FortiClientEMS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.16",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.7",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPortal versions 7.0.x ant\u00e9rieures \u00e0 7.0.7",
      "product": {
        "name": "FortiPortal",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.4.x ant\u00e9rieures \u00e0 7.4.2",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPortal versions ant\u00e9rieures \u00e0 7.0.0",
      "product": {
        "name": "FortiPortal",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientEMS versions 7.0.x ant\u00e9rieures \u00e0 7.0.11",
      "product": {
        "name": "FortiClientEMS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiClientEMS versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
      "product": {
        "name": "FortiClientEMS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer-BigData versions 7.4.x ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions 7.0.x. ant\u00e9rieures \u00e0 7.0.11",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.9",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.14",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.15",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\n## Contournement provisoire\n\nS\u2019il n\u2019est pas possible de proc\u00e9der \u00e0 l\u2019installation d\u2019une version\ncorrigeant la vuln\u00e9rabilit\u00e9, se r\u00e9f\u00e9rer aux mesures de contournement\npropos\u00e9es par l\u2019\u00e9diteur \u00e0 la section *Workaround*.\n",
  "cves": [
    {
      "name": "CVE-2024-21761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21761"
    },
    {
      "name": "CVE-2023-42790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42790"
    },
    {
      "name": "CVE-2023-41842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41842"
    },
    {
      "name": "CVE-2023-48788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-48788"
    },
    {
      "name": "CVE-2024-23112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23112"
    },
    {
      "name": "CVE-2023-46717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46717"
    },
    {
      "name": "CVE-2023-42789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42789"
    },
    {
      "name": "CVE-2023-47534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47534"
    },
    {
      "name": "CVE-2023-36554",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36554"
    }
  ],
  "initial_release_date": "2024-03-13T00:00:00",
  "last_revision_date": "2024-03-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0212",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Fortinet\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un\ncontournement de la politique de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-007 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-24-007"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-304 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-304"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-016 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-24-016"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-328 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-328"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-424 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-424"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-390 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-390"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-103 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-103"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-24-013 du 12 mars 2024",
      "url": "https://www.fortiguard.com/psirt/FG-IR-24-013"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FortiAnalyzer ist eine Plattform zur Protokollverwaltung, Analyse und Berichterstellung.\r\nFortiManager Security Management Appliances erm\u00f6glicht die Verwaltung von Fortinet Network Security Ger\u00e4ten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Fortinet FortiAnalyzer und Fortinet FortiManager ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0600 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0600.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0600 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0600"
      },
      {
        "category": "external",
        "summary": "Fortinet Security Advisory vom 2024-03-12",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-103"
      },
      {
        "category": "external",
        "summary": "Fortinet Security Advisory vom 2024-03-12",
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-304"
      }
    ],
    "source_lang": "en-US",
    "title": "Fortinet FortiAnalyzer und Fortinet FortiManager: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2024-03-12T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:06:19.904+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-0600",
      "initial_release_date": "2024-03-12T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-03-12T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.4.2",
                "product": {
                  "name": "Fortinet FortiAnalyzer \u003c 7.4.2",
                  "product_id": "T033388"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.2.4",
                "product": {
                  "name": "Fortinet FortiAnalyzer \u003c 7.2.4",
                  "product_id": "T033390"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.0.10",
                "product": {
                  "name": "Fortinet FortiAnalyzer \u003c 7.0.10",
                  "product_id": "T033391"
                }
              },
              {
                "category": "product_version_range",
                "name": "Big-Data \u003c 7.4.0",
                "product": {
                  "name": "Fortinet FortiAnalyzer Big-Data \u003c 7.4.0",
                  "product_id": "T033392"
                }
              },
              {
                "category": "product_version_range",
                "name": "Big-Data \u003c 7.2.6",
                "product": {
                  "name": "Fortinet FortiAnalyzer Big-Data \u003c 7.2.6",
                  "product_id": "T033393"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiAnalyzer"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.4.2",
                "product": {
                  "name": "Fortinet FortiManager \u003c 7.4.2",
                  "product_id": "T033394"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.2.4",
                "product": {
                  "name": "Fortinet FortiManager \u003c 7.2.4",
                  "product_id": "T033395"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.0.10",
                "product": {
                  "name": "Fortinet FortiManager \u003c 7.0.10",
                  "product_id": "T033396"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.4.1",
                "product": {
                  "name": "Fortinet FortiManager \u003c 7.4.1",
                  "product_id": "T033397"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 7.0.11",
                "product": {
                  "name": "Fortinet FortiManager \u003c 7.0.11",
                  "product_id": "T033398"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c 6.4.14",
                "product": {
                  "name": "Fortinet FortiManager \u003c 6.4.14",
                  "product_id": "T033399"
                }
              }
            ],
            "category": "product_name",
            "name": "FortiManager"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-36554",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiManager. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Zugriffskontrolle. Durch das Senden speziell gestalteter Anfragen kann ein entfernter, anonymer Angreifer diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T033396"
        ]
      },
      "release_date": "2024-03-12T23:00:00.000+00:00",
      "title": "CVE-2023-36554"
    },
    {
      "cve": "CVE-2023-41842",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiAnalyzer und Fortinet FortiManager. Dieser Fehler besteht aufgrund der Verwendung eines von au\u00dfen gesteuerten Formatstrings. Durch das Senden eines speziell gestalteten Befehls kann ein lokaler Angreifer diese Schwachstelle ausnutzen, um beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T033399",
          "T033397"
        ]
      },
      "release_date": "2024-03-12T23:00:00.000+00:00",
      "title": "CVE-2023-41842"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-41842",
    "id": "GSD-2023-41842"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-41842"
      ],
      "details": "A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and  Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.",
      "id": "GSD-2023-41842",
      "modified": "2023-12-13T01:20:45.122763Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@fortinet.com",
        "ID": "CVE-2023-41842",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FortiManager",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.4.0",
                          "version_value": "7.4.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.2.0",
                          "version_value": "7.2.3"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.0",
                          "version_value": "7.0.9"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.4.0",
                          "version_value": "6.4.14"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.2.0",
                          "version_value": "6.2.12"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "FortiAnalyzer",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.4.0",
                          "version_value": "7.4.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.2.0",
                          "version_value": "7.2.3"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.0",
                          "version_value": "7.0.9"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.4.0",
                          "version_value": "6.4.14"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.2.0",
                          "version_value": "6.2.12"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "FortiPortal",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.0.0",
                          "version_value": "6.0.14"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "5.3.0",
                          "version_value": "5.3.8"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Fortinet"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and  Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-134",
                "lang": "eng",
                "value": "Execute unauthorized code or commands"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://fortiguard.com/psirt/FG-IR-23-304",
            "refsource": "MISC",
            "url": "https://fortiguard.com/psirt/FG-IR-23-304"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiManager version 7.4.2 or above \nPlease upgrade to FortiManager version 7.2.4 or above \nPlease upgrade to FortiManager version 7.0.10 or above \nPlease upgrade to FortiAnalyzer version 7.4.2 or above \nPlease upgrade to FortiAnalyzer version 7.2.4 or above \nPlease upgrade to FortiAnalyzer version 7.0.10 or above \nPlease upgrade to FortiAnalyzer-BigData version 7.4.0 or above \nPlease upgrade to FortiAnalyzer-BigData version 7.2.6 or above \nPlease upgrade to FortiPortal version 7.0.0 or above \n"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "18205067-639E-4A90-AF8C-DA71FB65AEFA",
                    "versionEndExcluding": "7.0.10",
                    "versionStartIncluding": "6.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E0D5DF6-69C6-4325-94D3-D7A44862F62C",
                    "versionEndExcluding": "7.2.4",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CB15106A-8295-4A9E-B5C8-FA9654636B15",
                    "versionEndExcluding": "7.4.2",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer_bigdata:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7299FC61-369D-4F07-B0E1-1FD9E2E371A3",
                    "versionEndIncluding": "6.4.7",
                    "versionStartIncluding": "6.4.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer_bigdata:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9417A7DF-F260-45C2-A224-D6FB08792C58",
                    "versionEndIncluding": "7.0.6",
                    "versionStartIncluding": "7.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer_bigdata:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A06370D3-3917-4D9E-980D-52621794A671",
                    "versionEndExcluding": "7.2.6",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer_bigdata:6.2.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11815CDE-B157-457A-AB0D-DA73A0F4656C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BBD0FF48-FC1A-4406-B939-7E83ED65A57E",
                    "versionEndExcluding": "7.0.10",
                    "versionStartIncluding": "6.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5BC35BBC-5F0C-4802-8F00-643D465D43E4",
                    "versionEndExcluding": "7.2.4",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "83316FAF-C5DE-4603-B3B2-6796E2FAF1A8",
                    "versionEndExcluding": "7.4.2",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CC626329-3FCF-45BE-955B-82A495B10FA6",
                    "versionEndIncluding": "6.0.14",
                    "versionStartIncluding": "5.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and  Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments."
          },
          {
            "lang": "es",
            "value": "Un uso de vulnerabilidad de cadena de formato controlada externamente [CWE-134] en Fortinet FortiManager versi\u00f3n 7.4.0 a 7.4.1, versi\u00f3n 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer versi\u00f3n 7.4.0 a 7.4.1 , versi\u00f3n 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer-BigData anterior a 7.2.5 y Fortinet FortiPortal versi\u00f3n 6.0 todas las versiones y la versi\u00f3n 5.3 todas las versiones permite a un atacante privilegiado ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de argumentos de comando especialmente manipulados."
          }
        ],
        "id": "CVE-2023-41842",
        "lastModified": "2024-03-21T21:04:13.000",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 5.9,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-03-12T15:15:45.920",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-23-304"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-134"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-41842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-134"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-12T15:15:45Z",
    "severity": "MODERATE"
  },
  "details": "A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and  Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.",
  "id": "GHSA-6v7m-rgwp-qcr4",
  "modified": "2024-03-12T15:32:21Z",
  "published": "2024-03-12T15:32:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41842"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-23-304"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18205067-639E-4A90-AF8C-DA71FB65AEFA",
              "versionEndExcluding": "7.0.10",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E0D5DF6-69C6-4325-94D3-D7A44862F62C",
              "versionEndExcluding": "7.2.4",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB15106A-8295-4A9E-B5C8-FA9654636B15",
              "versionEndExcluding": "7.4.2",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer_big_data:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDF502BF-F59E-4CB9-8E1F-A2F3BD982B43",
              "versionEndIncluding": "6.4.7",
              "versionStartIncluding": "6.4.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer_big_data:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "08104560-68B1-4264-9C2A-361FB0FC27DC",
              "versionEndIncluding": "7.0.6",
              "versionStartIncluding": "7.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer_big_data:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "765A3C8E-92B5-42B2-A9CF-D7A69B7AB258",
              "versionEndExcluding": "7.2.6",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer_big_data:6.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "55D89D70-6363-4509-95B2-FCE99B5D2158",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBD0FF48-FC1A-4406-B939-7E83ED65A57E",
              "versionEndExcluding": "7.0.10",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5BC35BBC-5F0C-4802-8F00-643D465D43E4",
              "versionEndExcluding": "7.2.4",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "83316FAF-C5DE-4603-B3B2-6796E2FAF1A8",
              "versionEndExcluding": "7.4.2",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0123003E-587B-4EC8-83B6-0C5D87A8AC10",
              "versionEndExcluding": "6.0.15",
              "versionStartIncluding": "5.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet  allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments."
    },
    {
      "lang": "es",
      "value": "Un uso de vulnerabilidad de cadena de formato controlada externamente [CWE-134] en Fortinet FortiManager versi\u00f3n 7.4.0 a 7.4.1, versi\u00f3n 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer versi\u00f3n 7.4.0 a 7.4.1 , versi\u00f3n 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer-BigData anterior a 7.2.5 y Fortinet FortiPortal versi\u00f3n 6.0 todas las versiones y la versi\u00f3n 5.3 todas las versiones permite a un atacante privilegiado ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de argumentos de comando especialmente manipulados."
    }
  ],
  "id": "CVE-2023-41842",
  "lastModified": "2026-01-14T14:16:08.650",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-03-12T15:15:45.920",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-23-304"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-23-304"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}