CVE-2023-36635
Assigner: fortinet
Published: 2023-09-07T12:41:13.903Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiSwitchManager
defaultStatus: unaffected
versions: versionType: semver
version: 7.2.0
lessThanOrEqual: 7.2.2
status: affected
versionType: semver
version: 7.0.0
lessThanOrEqual: 7.0.1
status: affected
descriptions: value: An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2
7.0.0 through 7.0.1 may allow a remote authenticated read-only user to modify the interface settings via the API.
problemTypes: descriptions: cweId: CWE-284
description: Improper access control
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:F/RL:X/RC:X
solutions: value: Please upgrade to FortiOS version 7.2.1 or above
Please upgrade to FortiOS version 7.0.8 or above
Please upgrade to FortiSwitchManager version 7.2.2 or above
Please upgrade to FortiSwitchManager version 7.0.2 or above