CVE-2023-26208
Assigner: fortinet
Published: 2023-03-09T14:55:08.396Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiAuthenticator
defaultStatus: unaffected
versions: versionType: semver
version: 6.4.0
lessThanOrEqual: 6.4.6
status: affected
versionType: semver
version: 6.3.0
lessThanOrEqual: 6.3.3
status: affected
versionType: semver
version: 6.2.0
lessThanOrEqual: 6.2.1
status: affected
versionType: semver
version: 6.1.0
lessThanOrEqual: 6.1.2
status: affected
versionType: semver
version: 6.0.0
lessThanOrEqual: 6.0.7
status: affected
descriptions: value: A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows  a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.
problemTypes: descriptions: cweId: CWE-307
description: Denial of service
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X
solutions: value: Please upgrade to FortiAuthenticator version 6.5.0 or above,
Please upgrade to FortiDeceptor version 3.2.0 or above.
Please upgrade to FortiMail version 6.4.1 or above,
Please upgrade to FortiMail version 6.2.5 or above,
Please upgrade to FortiMail version 6.0.10 or above.