CVE-2023-23775 - Vulnerability Details - OpenCVE

Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fortinet	Fortisoar

Configuration 1 [-]

cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fortiguard.com/psirt/FG-IR-22-448

History

Tue, 21 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Fortinet Fortinet fortisoar
CPEs		cpe:2.3:a:fortinet:fortisoar::::::::
Vendors & Products		Fortinet Fortinet fortisoar

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2024-06-11T14:32:00.651Z

Updated: 2024-08-02T10:42:26.252Z

Reserved: 2023-01-18T08:30:21.306Z

Link: CVE-2023-23775

Vulnrichment

Updated: 2024-08-02T10:42:26.252Z

NVD

Status : Analyzed

Published: 2024-06-11T15:15:53.723

Modified: 2025-01-21T21:56:39.483

Link: CVE-2023-23775

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23775", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-01-18T08:30:21.306Z", "datePublished": "2024-06-11T14:32:00.651Z", "dateUpdated": "2024-08-02T10:42:26.252Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSOAR", "defaultStatus": "unaffected", "versions": [{"version": "7.2.0", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in\u00a0SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR\u00a07.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-06-11T14:32:00.651Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSOAR version 7.2.1 or above \n"}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-448", "url": "https://fortiguard.com/psirt/FG-IR-22-448"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T18:46:02.668574Z", "id": "CVE-2023-23775", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T18:46:10.782Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:26.252Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-448", "url": "https://fortiguard.com/psirt/FG-IR-22-448", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-448", "name": "https://fortiguard.com/psirt/FG-IR-22-448", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:42:26.252Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-23775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-11T18:46:02.668574Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T18:46:07.776Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Fortinet", "product": "FortiSOAR", "versions": [{"status": "affected", "version": "7.2.0"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSOAR version 7.2.1 or above \n"}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-448", "name": "https://fortiguard.com/psirt/FG-IR-22-448"}], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in\u00a0SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR\u00a07.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2024-06-11T14:32:00.651Z"}}}, "cveMetadata": {"cveId": "CVE-2023-23775", "state": "PUBLISHED", "dateUpdated": "2024-08-02T10:42:26.252Z", "dateReserved": "2023-01-18T08:30:21.306Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2024-06-11T14:32:00.651Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisoar:*:*:*:*:*:*:*:*", "matchCriteriaId": "C649B619-D676-440E-9329-8467A2DD769E", "versionEndExcluding": "7.2.1", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple improper neutralization of special elements used in\u00a0SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR\u00a07.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de neutralizaci\u00f3n inadecuada de elementos especiales utilizados en comandos SQL (\"Inyecci\u00f3n SQL\") [CWE-89] en FortiSOAR 7.2.0 y anteriores a 7.0.3 pueden permitir que un atacante autenticado ejecute c\u00f3digo o comandos no autorizados a trav\u00e9s de par\u00e1metros de cadenas espec\u00edficamente manipulados."}], "id": "CVE-2023-23775", "lastModified": "2025-01-21T21:56:39.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@fortinet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-11T15:15:53.723", "references": [{"source": "psirt@fortinet.com", "tags": ["Broken Link"], "url": "https://fortiguard.com/psirt/FG-IR-22-448"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://fortiguard.com/psirt/FG-IR-22-448"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}