FortiSIEM - Bruteforce of Exposed Endpoints

Summary

An improper restriction of excessive authentication attempts [CWE-307] in FortiSIEM may allow a unauthenticated user with access to several endpoints to perform a brute force attack on these endpoints.

Affected Products

FortiSIEM version 6.7.0
FortiSIEM 6.6 all versions
FortiSIEM 6.5 all versions
FortiSIEM 6.4 all versions
FortiSIEM 6.3 all versions
FortiSIEM 6.2 all versions
FortiSIEM 6.1 all versions
FortiSIEM 5.4 all versions
FortiSIEM 5.3 all versions
FortiSIEM 5.2 all versions
FortiSIEM 5.1 all versions

Solutions

Please upgrade to FortiSIEM version 7.0.0 or above
Please upgrade to FortiSIEM version 6.7.1 or above

Acknowledgement

Internally discovered and reported by Théo Leleu and Austin Stark of Fortinet Product Security team.

Timeline

2023-06-09: Initial publication