Sign-up

ID

VAR-202401-2636


CVE

CVE-2023-37932


DESCRIPTION

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests

Trust: 1.0

sources: NVD: CVE-2023-37932

AFFECTED PRODUCTS

vendor:fortinetmodel:fortivoicescope:gteversion:6.0.0

Trust: 1.0

vendor:fortinetmodel:fortivoicescope:lteversion:6.0.12

Trust: 1.0

vendor:fortinetmodel:fortivoicescope:ltversion:6.4.8

Trust: 1.0

vendor:fortinetmodel:fortivoicescope:eqversion:7.0.0

Trust: 1.0

vendor:fortinetmodel:fortivoicescope:gteversion:6.4.0

Trust: 1.0

sources: NVD: CVE-2023-37932

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-37932
value: MEDIUM

Trust: 1.0

psirt@fortinet.com: CVE-2023-37932
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2023-37932
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 2.0

sources: NVD: CVE-2023-37932 // NVD: CVE-2023-37932

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

sources: NVD: CVE-2023-37932

EXTERNAL IDS

db:NVDid:CVE-2023-37932

Trust: 1.0

sources: NVD: CVE-2023-37932

REFERENCES

url:https://fortiguard.com/psirt/fg-ir-23-219

Trust: 1.0

sources: NVD: CVE-2023-37932

SOURCES

db:NVDid:CVE-2023-37932

LAST UPDATE DATE

2024-08-14T15:20:39.761000+00:00


SOURCES UPDATE DATE

db:NVDid:CVE-2023-37932date:2024-01-18T15:50:39.943

SOURCES RELEASE DATE

db:NVDid:CVE-2023-37932date:2024-01-10T18:15:45.570