CVE-2023-40714 - Vulnerability Details - OpenCVE

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://fortiguard.com/psirt/FG-IR-23-085

History

Wed, 02 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 02 Apr 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements
Weaknesses		CWE-23
References		https://fortiguard.com/psirt/FG-IR-23-085
Metrics		cvssV3_1 `{'score': 9.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2025-04-02T08:06:48.075Z

Updated: 2025-04-02T16:16:37.645Z

Reserved: 2023-08-21T09:03:44.315Z

Link: CVE-2023-40714

Vulnrichment

Updated: 2025-04-02T16:16:27.737Z

NVD

Status : Awaiting Analysis

Published: 2025-04-02T08:15:13.530

Modified: 2025-04-02T14:58:07.527

Link: CVE-2023-40714

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-40714", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-08-21T09:03:44.315Z", "datePublished": "2025-04-02T08:06:48.075Z", "dateUpdated": "2025-04-02T16:16:37.645Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSIEM", "cpes": [], "defaultStatus": "unaffected", "versions": [{"version": "7.0.0", "status": "affected"}, {"versionType": "semver", "version": "6.7.0", "lessThanOrEqual": "6.7.2", "status": "affected"}, {"versionType": "semver", "version": "6.6.0", "lessThanOrEqual": "6.6.3", "status": "affected"}, {"versionType": "semver", "version": "6.5.0", "lessThanOrEqual": "6.5.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements"}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-04-02T08:06:48.075Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-23", "description": "Escalation of privilege", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.7, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSIEM version 7.0.1 or above\nPlease upgrade to FortiSIEM version 6.7.4 or above\nPlease upgrade to FortiSIEM version 6.6.4 or above\nPlease upgrade to FortiSIEM version 6.5.2 or above\nPlease upgrade to FortiSIEM version 6.4.3 or above"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-23-085", "url": "https://fortiguard.com/psirt/FG-IR-23-085"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-02T16:14:52.268463Z", "id": "CVE-2023-40714", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T16:16:37.645Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-40714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-02T16:14:52.268463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T16:16:27.737Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.7, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": [], "vendor": "Fortinet", "product": "FortiSIEM", "versions": [{"status": "affected", "version": "7.0.0"}, {"status": "affected", "version": "6.7.0", "versionType": "semver", "lessThanOrEqual": "6.7.2"}, {"status": "affected", "version": "6.6.0", "versionType": "semver", "lessThanOrEqual": "6.6.3"}, {"status": "affected", "version": "6.5.0", "versionType": "semver", "lessThanOrEqual": "6.5.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSIEM version 7.0.1 or above\nPlease upgrade to FortiSIEM version 6.7.4 or above\nPlease upgrade to FortiSIEM version 6.6.4 or above\nPlease upgrade to FortiSIEM version 6.5.2 or above\nPlease upgrade to FortiSIEM version 6.4.3 or above"}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-085", "name": "https://fortiguard.com/psirt/FG-IR-23-085"}], "descriptions": [{"lang": "en", "value": "A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "Escalation of privilege"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-04-02T08:06:48.075Z"}}}, "cveMetadata": {"cveId": "CVE-2023-40714", "state": "PUBLISHED", "dateUpdated": "2025-04-02T16:16:37.645Z", "dateReserved": "2023-08-21T09:03:44.315Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2025-04-02T08:06:48.075Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}