CVE-2023-45581
Full vulnerability record from the local CVENow database.
Description
An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2024-02-15 14:15:45.033000
Last modified
2026-10-22 14:17:33.540000
View original CVE JSON
{
"id": "CVE-2023-45581",
"sourceIdentifier": "[email protected]",
"published": "2024-02-15T14:15:45.033",
"lastModified": "2026-10-22T14:17:33.540",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests."
},
{
"lang": "es",
"value": "Una vulnerabilidad de administración de privilegios inadecuada [CWE-269] en Fortinet FortiClientEMS versión 7.2.0 a 7.2.2 y anteriores a 7.0.10 permite a un administrador del sitio con privilegios de superadministrador realizar operaciones administrativas globales que afectan a otros sitios a través de solicitudes HTTP o HTTPS manipuladas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Fortinet",
"product": "FortiClientEMS",
"defaultStatus": "unaffected",
"cpes": [
"cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.02:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.01:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlientems:06.02.00:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.6",
"lessThanOrEqual": "7.0.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.7",
"lessThanOrEqual": "6.4.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.4.0",
"lessThanOrEqual": "6.4.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.2.6",
"lessThanOrEqual": "6.2.9",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.2.3",
"lessThanOrEqual": "6.2.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "06.02.00",
"lessThanOrEqual": "06.02.02",
"versionType": "semver",
"status": "affected"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"vendor": "fortinet",
"product": "forticlient_enterprise_management_server",
"defaultStatus": "unknown",
"cpes": [
"cpe:2.3:a:fortinet:forticlient_enterprise_management_server:6.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlient_enterprise_management_server:6.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlient_enterprise_management_server:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlient_enterprise_management_server:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:forticlient_enterprise_management_server:7.2.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "6.2.0",
"lessThan": "6.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.4.0",
"lessThan": "6.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.0",
"lessThanOrEqual": "7.0.4",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.6",
"lessThanOrEqual": "7.0.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.2.0",
"lessThanOrEqual": "7.2.2",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-07-09T17:06:14.506422Z",
"id": "CVE-2023-45581",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"matchCriteriaId": "17D081E7-E4F0-4E0F-BEBF-BF3AD0641861"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.2.0",
"versionEndIncluding": "7.2.2",
"matchCriteriaId": "3C4BC53A-0E69-4CDE-B89A-E6AAC3ADB1E0"
}
]
}
]
}
],
"references": [
{
"url": "https://fortiguard.com/psirt/FG-IR-23-357",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://fortiguard.com/psirt/FG-IR-23-357",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}