Syslog not protected by an extra layer of authentication Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-23-221 Final 1 1 2023-10-10T00:00:00 Current version 2023-10-10T00:00:00 2023-10-30T00:00:00 A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer, FortiAnalyzer-BigData and FortiManager with FortiAnalyzer features may allow a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number. None Improper access control FortiManager version 7.4.0FortiManager version 7.2.0 through 7.2.3FortiManager version 7.0.0 through 7.0.9FortiManager 6.4 all versionsFortiManager 6.2 all versionsFortiAnalyzer-BigData 7.4 all versions are not affectedFortiAnalyzer-BigData version 7.2.0 through 7.2.5FortiAnalyzer-BigData 7.0 all versionsFortiAnalyzer-BigData 6.4 all versionsFortiAnalyzer-BigData 6.2 all versionsFortiAnalyzer version 7.4.0FortiAnalyzer version 7.2.0 through 7.2.3FortiAnalyzer version 7.0.0 through 7.0.9FortiAnalyzer 6.4 all versionsFortiAnalyzer 6.2 all versions Please upgrade to FortiAnalyzer-BigData version 7.4.0 or abovePlease upgrade to FortiAnalyzer-BigData version 7.2.6 or abovePlease upgrade to FortiManager version 7.4.1 or abovePlease upgrade to FortiManager version 7.2.4 or abovePlease upgrade to FortiManager version 7.0.10 or abovePlease upgrade to FortiAnalyzer version 7.4.1 or abovePlease upgrade to FortiAnalyzer version 7.2.4 or abovePlease upgrade to FortiAnalyzer version 7.0.10 or aboveAND Configure the "un-encrypted-logging" option to disable receiving syslog without encryption through UDP(514) or TCP(514).config system log setting set un-encrypted-logging disable Internally discovered and reported by Francesco Pesare from Fortinet's professional services team. FortiAnalyzer 7.4.0 FortiAnalyzer 7.2.3 FortiAnalyzer 7.2.2 FortiAnalyzer 7.2.1 FortiAnalyzer 7.2.0 FortiAnalyzer 7.0.9 FortiAnalyzer 7.0.8 FortiAnalyzer 7.0.7 FortiAnalyzer 7.0.6 FortiAnalyzer 7.0.5 FortiAnalyzer 7.0.4 FortiAnalyzer 7.0.3 FortiAnalyzer 7.0.2 FortiAnalyzer 7.0.1 FortiAnalyzer 7.0.0 FortiAnalyzer 6.4.15 FortiAnalyzer 6.4.14 FortiAnalyzer 6.4.13 FortiAnalyzer 6.4.12 FortiAnalyzer 6.4.11 FortiAnalyzer 6.4.10 FortiAnalyzer 6.4.9 FortiAnalyzer 6.4.8 FortiAnalyzer 6.4.7 FortiAnalyzer 6.4.6 FortiAnalyzer 6.4.5 FortiAnalyzer 6.4.4 FortiAnalyzer 6.4.3 FortiAnalyzer 6.4.2 FortiAnalyzer 6.4.1 FortiAnalyzer 6.4.0 FortiAnalyzer 6.2.13 FortiAnalyzer 6.2.12 FortiAnalyzer 6.2.11 FortiAnalyzer 6.2.10 FortiAnalyzer 6.2.9 FortiAnalyzer 6.2.8 FortiAnalyzer 6.2.7 FortiAnalyzer 6.2.6 FortiAnalyzer 6.2.5 FortiAnalyzer 6.2.4 FortiAnalyzer 6.2.3 FortiAnalyzer 6.2.2 FortiAnalyzer 6.2.1 FortiAnalyzer 6.2.0 FortiAnalyzer-BigData 7.2.5 FortiAnalyzer-BigData 7.2.4 FortiAnalyzer-BigData 7.2.3 FortiAnalyzer-BigData 7.2.2 FortiAnalyzer-BigData 7.2.1 FortiAnalyzer-BigData 7.2.0 FortiAnalyzer-BigData 7.0.6 FortiAnalyzer-BigData 7.0.5 FortiAnalyzer-BigData 7.0.4 FortiAnalyzer-BigData 7.0.3 FortiAnalyzer-BigData 7.0.2 FortiAnalyzer-BigData 7.0.1 FortiAnalyzer-BigData 6.4.7 FortiAnalyzer-BigData 6.4.6 FortiAnalyzer-BigData 6.4.5 FortiAnalyzer-BigData 6.2.5 FortiManager 7.4.0 FortiManager 7.2.3 FortiManager 7.2.2 FortiManager 7.2.1 FortiManager 7.2.0 FortiManager 7.0.9 FortiManager 7.0.8 FortiManager 7.0.7 FortiManager 7.0.6 FortiManager 7.0.5 FortiManager 7.0.4 FortiManager 7.0.3 FortiManager 7.0.2 FortiManager 7.0.1 FortiManager 7.0.0 FortiManager 6.4.15 FortiManager 6.4.14 FortiManager 6.4.13 FortiManager 6.4.12 FortiManager 6.4.11 FortiManager 6.4.10 FortiManager 6.4.9 FortiManager 6.4.8 FortiManager 6.4.7 FortiManager 6.4.6 FortiManager 6.4.5 FortiManager 6.4.4 FortiManager 6.4.3 FortiManager 6.4.2 FortiManager 6.4.1 FortiManager 6.4.0 FortiManager 6.2.13 FortiManager 6.2.12 FortiManager 6.2.11 FortiManager 6.2.10 FortiManager 6.2.9 FortiManager 6.2.8 FortiManager 6.2.7 FortiManager 6.2.6 FortiManager 6.2.5 FortiManager 6.2.4 FortiManager 6.2.3 FortiManager 6.2.2 FortiManager 6.2.1 FortiManager 6.2.0 CVE-2023-42782 FortiAnalyzer-7.4.0 FortiAnalyzer-7.2.3 FortiAnalyzer-7.2.2 FortiAnalyzer-7.2.1 FortiAnalyzer-7.2.0 FortiAnalyzer-7.0.9 FortiAnalyzer-7.0.8 FortiAnalyzer-7.0.7 FortiAnalyzer-7.0.6 FortiAnalyzer-7.0.5 FortiAnalyzer-7.0.4 FortiAnalyzer-7.0.3 FortiAnalyzer-7.0.2 FortiAnalyzer-7.0.1 FortiAnalyzer-7.0.0 FortiAnalyzer-6.4.15 FortiAnalyzer-6.4.14 FortiAnalyzer-6.4.13 FortiAnalyzer-6.4.12 FortiAnalyzer-6.4.11 FortiAnalyzer-6.4.10 FortiAnalyzer-6.4.9 FortiAnalyzer-6.4.8 FortiAnalyzer-6.4.7 FortiAnalyzer-6.4.6 FortiAnalyzer-6.4.5 FortiAnalyzer-6.4.4 FortiAnalyzer-6.4.3 FortiAnalyzer-6.4.2 FortiAnalyzer-6.4.1 FortiAnalyzer-6.4.0 FortiAnalyzer-6.2.13 FortiAnalyzer-6.2.12 FortiAnalyzer-6.2.11 FortiAnalyzer-6.2.10 FortiAnalyzer-6.2.9 FortiAnalyzer-6.2.8 FortiAnalyzer-6.2.7 FortiAnalyzer-6.2.6 FortiAnalyzer-6.2.5 FortiAnalyzer-6.2.4 FortiAnalyzer-6.2.3 FortiAnalyzer-6.2.2 FortiAnalyzer-6.2.1 FortiAnalyzer-6.2.0 FortiAnalyzer-BigData-7.2.5 FortiAnalyzer-BigData-7.2.4 FortiAnalyzer-BigData-7.2.3 FortiAnalyzer-BigData-7.2.2 FortiAnalyzer-BigData-7.2.1 FortiAnalyzer-BigData-7.2.0 FortiAnalyzer-BigData-7.0.6 FortiAnalyzer-BigData-7.0.5 FortiAnalyzer-BigData-7.0.4 FortiAnalyzer-BigData-7.0.3 FortiAnalyzer-BigData-7.0.2 FortiAnalyzer-BigData-7.0.1 FortiAnalyzer-BigData-6.4.7 FortiAnalyzer-BigData-6.4.6 FortiAnalyzer-BigData-6.4.5 FortiAnalyzer-BigData-6.2.5 FortiManager-7.4.0 FortiManager-7.2.3 FortiManager-7.2.2 FortiManager-7.2.1 FortiManager-7.2.0 FortiManager-7.0.9 FortiManager-7.0.8 FortiManager-7.0.7 FortiManager-7.0.6 FortiManager-7.0.5 FortiManager-7.0.4 FortiManager-7.0.3 FortiManager-7.0.2 FortiManager-7.0.1 FortiManager-7.0.0 FortiManager-6.4.15 FortiManager-6.4.14 FortiManager-6.4.13 FortiManager-6.4.12 FortiManager-6.4.11 FortiManager-6.4.10 FortiManager-6.4.9 FortiManager-6.4.8 FortiManager-6.4.7 FortiManager-6.4.6 FortiManager-6.4.5 FortiManager-6.4.4 FortiManager-6.4.3 FortiManager-6.4.2 FortiManager-6.4.1 FortiManager-6.4.0 FortiManager-6.2.13 FortiManager-6.2.12 FortiManager-6.2.11 FortiManager-6.2.10 FortiManager-6.2.9 FortiManager-6.2.8 FortiManager-6.2.7 FortiManager-6.2.6 FortiManager-6.2.5 FortiManager-6.2.4 FortiManager-6.2.3 FortiManager-6.2.2 FortiManager-6.2.1 FortiManager-6.2.0 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-23-221 Syslog not protected by an extra layer of authentication Reference>