CVE-2023-36554

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 12, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-365555.4An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to exeCVE-2023-365568.8An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6CVE-2023-365577.8PrintHTML API Remote Code Execution VulnerabilityCVE-2023-365585.5ASP.NET Core Security Feature Bypass VulnerabilityCVE-2023-365594.2Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36569.8cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauCVE-2023-365608.8ASP.NET Security Feature Bypass VulnerabilityCVE-2023-365617.3Azure DevOps Server Elevation of Privilege VulnerabilityCVE-2023-365627.1Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-365635.5Microsoft WordPad Information Disclosure VulnerabilityCVE-2023-365646.5Windows Search Security Feature Bypass VulnerabilityCVE-2023-365657.0Microsoft Office Graphics Elevation of Privilege Vulnerability
CVE-2023-36554: Critical severity, CVSS 9.8 | Vulnix