CVE-2023-45586
En bref Sévérité MEDIUM 4.7 EPSS EPSS 0.29 % · centile 21 (2026-10-27) État PUBLISHED Publiée 2024-05-14 Mise à jour 2024-08-02 Attribuée par fortinet Statut NVD Modified Description An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 4.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N/E:P/RL:X/RC:C fortinet CVSS 3.1 MEDIUM 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.12cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.14cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.8cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*Produits affectés Produit Versions Fortinet · FortiProxy affected 7.4.0 ≤ 7.4.1 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.0 ≤ 7.0.13 ; affected 2.0.0 ≤ 2.0.14 Fortinet · FortiOS affected 7.4.0 ≤ 7.4.1 ; affected 7.2.0 ≤ 7.2.7 ; affected 7.0.0 ≤ 7.0.12 ; affected 6.4.0 ≤ 6.4.15 ; affected 6.2.0 ≤ 6.2.16
Références
Sources
