Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2023-41673: An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTT...
CVE-2023-41673 · published 2 years ago
Summary
An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortiadc |
>= 6.0.0, <= 6.0.4 >= 6.1.0, <= 6.1.6 >= 6.2.0, <= 6.2.6 >= 7.0.0, <= 7.0.5 7.1.0 7.1.1 7.1.2 7.2.0 7.4.0 cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:* |
Original advisory text
An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTT...
An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests.
References
- https://fortiguard.com/psirt/FG-IR-23-270 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-285Improper Authorization
Timeline
Published13 Dec 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-41673 · NVD
Track software like this
Free during beta