CVE-2023-26204

Summary

A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiSIEM6.7.0 <= 6.7.5affected
FortinetFortiSIEM6.6.0 <= 6.6.3affected
FortinetFortiSIEM6.5.0 <= 6.5.1affected
FortinetFortiSIEM6.4.0 <= 6.4.2affected
FortinetFortiSIEM6.3.0 <= 6.3.3affected
FortinetFortiSIEM6.2.0 <= 6.2.1affected
FortinetFortiSIEM6.1.0 <= 6.1.2affected
FortinetFortiSIEM5.4.0affected
FortinetFortiSIEM5.3.0 <= 5.3.3affected

Weaknesses

  • CWE-256: Improper access control

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References