CVE-2023-36638
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions API may allow a remote and authenticated API admin user to access some system settings such as the mail server settings through the API via a stolen GUI session ID.
| Software | From | Fixed in |
|---|---|---|
| fortinet / fortimanager | 6.4.0 | 6.4.12 |
| fortinet / fortianalyzer | 7.2.0 | 7.2.3 |
| fortinet / fortianalyzer | 7.0.0 | 7.0.8 |
| fortinet / fortianalyzer | 6.0.0 | 6.4.12 |
| fortinet / fortimanager | 7.2.0 | 7.2.3 |
| fortinet / fortimanager | 7.0.0 | 7.0.8 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime