CVE-2023-45586
At a glance Severity MEDIUM 4.7 EPSS EPSS 0.29 % · percentile 21 (2026-10-27) State PUBLISHED Published 2024-05-14 Updated 2024-08-02 Assigner fortinet NVD status Modified Description An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C fortinet CVSS 3.1 MEDIUM 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.12cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.14cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*Affected products Product Versions Fortinet · FortiProxy affected 7.4.0 ≤ 7.4.1 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.0 ≤ 7.0.13 ; affected 2.0.0 ≤ 2.0.14 Fortinet · FortiOS affected 7.4.0 ≤ 7.4.1 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.0 ≤ 7.0.12 ; affected 6.4.0 ≤ 6.4.15 ; affected 6.2.0 ≤ 6.2.16
References
Sources
