CVE-2023-40720

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-407216.7A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbiCVE-2023-407238.1An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and CVE-2023-407247.3A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attackeCVE-2023-407254.0A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages CVE-2023-407268.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive inforCVE-2023-407277.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak oCVE-2023-407287.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensCVE-2023-407297.4A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unCVE-2023-40738.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap cCVE-2023-407308.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks suffiCVE-2023-407318.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary filCVE-2023-407323.9A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not in
CVE-2023-40720: High severity, CVSS 7.1 | Vulnix