Server side request forgery on fortiview top threats report generation feature.

Server side request forgery on fortiview top threats report generation feature. Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-19-039 Final 1 1 2023-10-10T00:00:00 Current version 2023-10-10T00:00:00 2023-10-10T00:00:00 A server-side request forgery vulnerability [CWE-918] in FortiAnalyzer and FortiManager may allow a remote attacker with low privileges to view sensitive data from internal servers or perform a local port scan via a crafted HTTP request. None Information disclosure https://fortiguard.fortinet.com/psirt/FG-IR-19-039 Server side request forgery on fortiview top threats report generation feature. https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh Fortinet is pleased to thank security researchers Mickael Dorigny at Orange Cyberdéfense, Frédéric Prevost, François-Xavier Picard and Orange CERT-CC at Orange group for discovering and reporting this vulnerability under responsible disclosure. FortiAnalyzer 7.4.0 FortiAnalyzer 7.2.3 FortiAnalyzer 7.2.2 FortiAnalyzer 7.2.1 FortiAnalyzer 7.2.0 FortiAnalyzer 7.0.8 FortiAnalyzer 7.0.7 FortiAnalyzer 7.0.6 FortiAnalyzer 7.0.5 FortiAnalyzer 7.0.4 FortiAnalyzer 7.0.3 FortiAnalyzer 7.0.2 FortiAnalyzer 6.4.15 FortiAnalyzer 6.4.14 FortiAnalyzer 6.4.13 FortiAnalyzer 6.4.12 FortiAnalyzer 6.4.11 FortiAnalyzer 6.4.10 FortiAnalyzer 6.4.9 FortiAnalyzer 6.4.8 FortiAnalyzer Cloud 7.2.8 FortiAnalyzer Cloud 7.2.7 FortiAnalyzer Cloud 7.2.6 FortiAnalyzer Cloud 7.2.5 FortiAnalyzer Cloud 7.2.4 FortiAnalyzer Cloud 7.2.3 FortiAnalyzer Cloud 7.2.2 FortiAnalyzer Cloud 7.2.1 FortiAnalyzer Cloud 7.0.8 FortiAnalyzer Cloud 7.0.7 FortiAnalyzer Cloud 7.0.6 FortiAnalyzer Cloud 7.0.5 FortiAnalyzer Cloud 7.0.4 FortiAnalyzer Cloud 7.0.3 FortiAnalyzer Cloud 7.0.2 FortiAnalyzer Cloud 7.0.1 FortiAnalyzer Cloud 6.4.7 FortiAnalyzer Cloud 6.4.6 FortiAnalyzer Cloud 6.4.5 FortiAnalyzer Cloud 6.4.4 FortiAnalyzer Cloud 6.4.3 FortiAnalyzer Cloud 6.4.2 FortiAnalyzer Cloud 6.4.1 FortiManager 7.4.0 FortiManager 7.2.3 FortiManager 7.2.2 FortiManager 7.2.1 FortiManager 7.2.0 FortiManager 7.0.8 FortiManager 7.0.7 FortiManager 7.0.6 FortiManager 7.0.5 FortiManager 7.0.4 FortiManager 7.0.3 FortiManager 7.0.2 FortiManager 7.0.1 FortiManager 7.0.0 FortiManager Cloud 7.2.8 FortiManager Cloud 7.2.7 FortiManager Cloud 7.2.6 FortiManager Cloud 7.2.5 FortiManager Cloud 7.2.4 FortiManager Cloud 7.2.3 FortiManager Cloud 7.2.2 FortiManager Cloud 7.2.1 FortiManager Cloud 7.0.8 FortiManager Cloud 7.0.7 FortiManager Cloud 7.0.6 FortiManager Cloud 7.0.5 FortiManager Cloud 7.0.4 FortiManager Cloud 7.0.3 FortiManager Cloud 7.0.2 FortiManager Cloud 7.0.1 FortiManager Cloud 6.4.7 FortiManager Cloud 6.4.6 FortiManager Cloud 6.4.5 FortiManager Cloud 6.4.4 FortiManager Cloud 6.4.3 FortiManager Cloud 6.4.2 FortiManager Cloud 6.4.1 Server side request forgery on fortiview top threats report generation feature. CVE-2023-44256 FortiAnalyzer-7.4.0 FortiAnalyzer-7.2.3 FortiAnalyzer-7.2.2 FortiAnalyzer-7.2.1 FortiAnalyzer-7.2.0 FortiAnalyzer-7.0.8 FortiAnalyzer-7.0.7 FortiAnalyzer-7.0.6 FortiAnalyzer-7.0.5 FortiAnalyzer-7.0.4 FortiAnalyzer-7.0.3 FortiAnalyzer-7.0.2 FortiAnalyzer-6.4.15 FortiAnalyzer-6.4.14 FortiAnalyzer-6.4.13 FortiAnalyzer-6.4.12 FortiAnalyzer-6.4.11 FortiAnalyzer-6.4.10 FortiAnalyzer-6.4.9 FortiAnalyzer-6.4.8 FortiAnalyzer Cloud-7.2.8 FortiAnalyzer Cloud-7.2.7 FortiAnalyzer Cloud-7.2.6 FortiAnalyzer Cloud-7.2.5 FortiAnalyzer Cloud-7.2.4 FortiAnalyzer Cloud-7.2.3 FortiAnalyzer Cloud-7.2.2 FortiAnalyzer Cloud-7.2.1 FortiAnalyzer Cloud-7.0.8 FortiAnalyzer Cloud-7.0.7 FortiAnalyzer Cloud-7.0.6 FortiAnalyzer Cloud-7.0.5 FortiAnalyzer Cloud-7.0.4 FortiAnalyzer Cloud-7.0.3 FortiAnalyzer Cloud-7.0.2 FortiAnalyzer Cloud-7.0.1 FortiAnalyzer Cloud-6.4.7 FortiAnalyzer Cloud-6.4.6 FortiAnalyzer Cloud-6.4.5 FortiAnalyzer Cloud-6.4.4 FortiAnalyzer Cloud-6.4.3 FortiAnalyzer Cloud-6.4.2 FortiAnalyzer Cloud-6.4.1 FortiManager-7.4.0 FortiManager-7.2.3 FortiManager-7.2.2 FortiManager-7.2.1 FortiManager-7.2.0 FortiManager-7.0.8 FortiManager-7.0.7 FortiManager-7.0.6 FortiManager-7.0.5 FortiManager-7.0.4 FortiManager-7.0.3 FortiManager-7.0.2 FortiManager-7.0.1 FortiManager-7.0.0 FortiManager Cloud-7.2.8 FortiManager Cloud-7.2.7 FortiManager Cloud-7.2.6 FortiManager Cloud-7.2.5 FortiManager Cloud-7.2.4 FortiManager Cloud-7.2.3 FortiManager Cloud-7.2.2 FortiManager Cloud-7.2.1 FortiManager Cloud-7.0.8 FortiManager Cloud-7.0.7 FortiManager Cloud-7.0.6 FortiManager Cloud-7.0.5 FortiManager Cloud-7.0.4 FortiManager Cloud-7.0.3 FortiManager Cloud-7.0.2 FortiManager Cloud-7.0.1 FortiManager Cloud-6.4.7 FortiManager Cloud-6.4.6 FortiManager Cloud-6.4.5 FortiManager Cloud-6.4.4 FortiManager Cloud-6.4.3 FortiManager Cloud-6.4.2 FortiManager Cloud-6.4.1 6.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-19-039 Server side request forgery on fortiview top threats report generation feature. Reference> https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh https://github.com/orangecertcc/security-research/security/advisories/GHSA-2hc5-p5mc-8vrh