« Volver al listado

CVE-2023-44252

Estado: ModificadaAlta (8.8)—

** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Fortiwan

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-44252",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiWAN",
          "versions": [
            {
              "status": "affected",
              "version": "5.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.2.1"
            },
            {
              "status": "affected",
              "version": "5.1.1",
              "versionType": "semver",
              "lessThanOrEqual": "5.1.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-13T09:15:34.473",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-061",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-061",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values."
    },
    {
      "lang": "es",
      "value": "** NO COMPATIBLE CUANDO ESTÁ ASIGNADO ** Una vulnerabilidad de autenticación incorrecta [CWE-287] en Fortinet FortiWAN versión 5.2.0 a 5.2.1 y versión 5.1.1 a 5.1.2 puede permitir que un atacante autenticado escale sus privilegios a través de solicitudes HTTP o HTTPs con valores de token JWT manipulados."
    }
  ],
  "lastModified": "2026-06-17T06:27:13.387",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwan:5.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C010221E-9BAF-41DC-B352-5941D38C8FEF"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwan:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7944DB8-76F2-40B9-97E2-D14A1EBF6286"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwan:5.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BCE7940-6D64-43BE-92AF-3EB86F4D0B3E"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiwan:5.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C8034DF-A33B-4B49-9448-6AD1DFAB27D5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}