Rewterz Threat Advisory – Multiple Fortinet Products Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-36556 CVSS:8.8

Fortinet FortiMail could allow a remote authenticated attacker to bypass security restrictions, caused by an incorrect authorization vulnerability. By sending a specially crafted request, an attacker could exploit this vulnerability to takeover Email account in the same web domain.

CVE-2023-36637 CVSS:3.5

Fortinet FortiMail is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability using input field to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2023-33303 CVSS:8.1

Fortinet FortiEDR could allow a remote attacker to execute arbitrary code on the system, caused by an insufficient session expiration. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2023-37939 CVSS:3.3

Fortinet FortiClient could allow a local authenticated attacker to obtain sensitive information. By sending a specially crafted request, a remote attacker could exploit this vulnerability to retrieve the list of files or folders excluded from malware scanning.

CVE-2022-22298 CVSS:6.7

Fortinet FortiIsolator could allow a local authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2023-25604 CVSS:5.5

Fortinet FortiGuest could allow a local authenticated attacker to obtain sensitive information, caused by insertion of sensitive information into log files. An attacker could exploit this vulnerability to obtain plaintext passwords from RADIUS logs and use this information to launch further attacks against the affected system.

Impact

• Security Bypass
• Cross-Site Scripting
• Information Theft
• Code Execution
• Gain Access
• Information Disclosure

Indicators Of Compromise

CVE

• CVE-2023-36556
• CVE-2023-36637
• CVE-2023-33303
• CVE-2023-37939
• CVE-2023-22298
• CVE-2023-25604

Affected Vendors

Fortinet

Affected Products

• Fortinet FortiMail 7.2.2
• Fortinet FortiMail 7.2.1
• Fortinet FortiMail 7.2.0
• Fortinet FortiMail 7.0.5
• Fortinet FortiMail 7.0.4
• Fortinet FortiMail 7.0.3
• Fortinet FortiMail 7.0.1
• Fortinet FortiEDR 5.0.0
• Fortinet FortiEDR 5.0.1
• Fortinet FortiClientMac 7.2
• Fortinet FortiClientMac 7.0
• Fortinet FortiClientMac 6.4
• Fortinet FortiClientMac 6.2
• Fortinet FortiClientWindows 7.2
• Fortinet FortiClientWindows 7.0
• Fortinet FortiClientWindows 6.4
• Fortinet FortiClientWindows 6.2
• Fortinet FortiClientLinux 7.2
• Fortinet FortiClientLinux 7.0
• Fortinet FortiClientLinux 6.4
• Fortinet FortiClientLinux 6.2
• Fortinet FortiIsolator 1.0.0
• Fortinet FortiIsolator 1.1.0
• Fortinet FortiIsolator 1.2.0
• Fortinet FortiIsolator 2.0.0
• Fortinet FortiIsolator 2.0.1
• Fortinet FortiIsolator 2.1.0
• Fortinet FortiIsolator 2.2.0
• Fortinet FortiIsolator 2.3.0
• Fortinet FortiIsolator 2.3.4

Remediation

Refer to FortiGuard Advisory for patch, upgrade or suggested workaround information.

CVE-2023-36556

CVE-2023-36637

CVE-2023-33303

CVE-2023-37939

CVE-2023-22298

CVE-2023-25604