CVE-2023-45581CWE-269privilege-escalation

CVE-2023-45581

High · published February 15, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
56.9
In the wild
Unconfirmed
What it is

An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00823 · 56.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-02-15T19:15Z
Affected products (2)
ProductVersionsFixed in
fortinet/forticlient_enterprise_management_server< 7.0.107.0.10
fortinet/forticlient_enterprise_management_server≥ 7.2.0, ≤ 7.2.2—
References (2)
https://fortiguard.com/psirt/FG-IR-23-357 · [email protected]https://fortiguard.com/psirt/FG-IR-23-357 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 15 FEB 13:59Z
    An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and before 7.0.10 allows an Site administrator…
    cvelistv5