CVE-2023-26204

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-256 CWE-522

Affected software

Vendor	Product	Versions
Fortinet	FortiSIEM	>= 6.7.0, <= 6.7.5; >= 6.6.0, <= 6.6.3; >= 6.5.0, <= 6.5.1; >= 6.4.0, <= 6.4.2; >= 6.3.0, <= 6.3.3; >= 6.2.0, <= 6.2.1; >= 6.1.0, <= 6.1.2; 5.4.0; >= 5.3.0, <= 5.3.3

References

https://fortiguard.com/psirt/FG-IR-21-141Vendor Advisory
https://fortiguard.com/psirt/FG-IR-21-141Vendor Advisory

Timeline

Published: Jun 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-262058.8An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6 CVE-2023-262066.1An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9 CVE-2023-262076.5An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.1 CVE-2023-262085.3A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows CVE-2023-262095.3A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a rem CVE-2023-26216.5The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer syste CVE-2023-262107.8Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in CVE-2023-262119.0An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an CVE-2023-262137.2On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exis CVE-2023-262145.4The BusinessConnect UI component of TIBCO Software Inc.'s TIBCO BusinessConnect contains easily exploitable Reflected Cross Site Scripting (CVE-2023-262156.5The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged applica CVE-2023-262167.2The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload file