CVE-2023-42782

EUVD-2023-47212
A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
fortinetCNA
5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
fortinetfortianalyzer
6.2.0 ≤
𝑥
≤ 6.2.12
fortinetfortianalyzer
6.4.0 ≤
𝑥
≤ 6.4.13
fortinetfortianalyzer
7.0.0 ≤
𝑥
≤ 7.0.9
fortinetfortianalyzer
7.2.0 ≤
𝑥
≤ 7.2.3
fortinetfortianalyzer
7.4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://fortiguard.com/psirt/FG-IR-23-221
https://fortiguard.com/psirt/FG-IR-23-221