CVE-2023-48790
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Tags
Description
A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests.
Analysis
through 7.2.1 and 7.1.0 versions up to 7.1.1 is affected by cross-site request forgery (csrf) (CVSS 7.5).
Technical Context
This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affects through 7.2.1 and 7.1.0. A cross site request forgery vulnerability [CWE-352] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and before 7.0.5 may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests.
Affected Products
Product: through 7.2.1 and 7.1.0. Versions: up to 7.1.1.
Remediation
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today