What is CVE-2023-36638?

CVE-2023-36638 is a medium-severity vulnerability in Fortinet Fortianalyzer, classified under Improper Access Control. CVSS score: 4.3/10. Published 2023-09-13.

How severe is CVE-2023-36638?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Fortinet Fortianalyzer

CVE-2023-36638

An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.

EPSS: 0.003 (26.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Fortinet Fortianalyzer — versions 7.2.0, 7.0.0, 6.4.0
Fortinet Fortimanager — versions 7.2.0, 7.0.0, 6.4.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-36638?: CVE-2023-36638 is a medium-severity vulnerability in Fortinet Fortianalyzer, classified under Improper Access Control. CVSS score: 4.3/10. Published 2023-09-13.
How severe is CVE-2023-36638?: Medium severity. CVSS v3 base score is 4.3 out of 10.