CVE-2023-37935CWE-598

A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view…

Medium · published October 10, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.01124 · 66.0th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2023-10-10T16:51Z
EPSS history
Timeline
  • 10 OCT 16:51Z
    A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view…
    cvelistv5