CVE-2023-45586CWE-345

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0…

Medium · published May 14, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2024-05-14T16:19Z
EPSS history
Timeline
  • 14 MAY 16:19Z
    An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0…
    cvelistv5