CVE-2023-44255

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions prior to 7.4.2 Fortinet FortiAnalyzer versions prior to 7.4.2 Fortinet FortiAnalyzer-BigData versions prior to 7.2.5

Description The issue is related to exposure of sensitive information to an unauthorized actor, which may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP or HTTPS requests. This is due to insufficient access control to personal information.

Recommendations For Fortinet FortiManager versions prior to 7.4.2, update to version 7.4.2 or later. For Fortinet FortiAnalyzer versions prior to 7.4.2, update to version 7.4.2 or later. For Fortinet FortiAnalyzer-BigData versions prior to 7.2.5, update to version 7.2.5 or later. As a temporary workaround, consider restricting access to event logs to minimize the risk of exploitation.