CVE-2023-42782

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Fortinet	FortiAnalyzer	7.4.0; >= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.9; >= 6.4.0, <= 6.4.13; >= 6.2.0, <= 6.2.12
fortinet	fortianalyzer	7.4.0; >= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.9; >= 6.4.0, <= 6.4.13; >= 6.2.0, <= 6.2.12
fortinet	fortianalyzer-bigdata	>= 7.2.0, <= 7.2.5; 7.0; 6.4; 6.2
fortinet	fortimanager	7.4.0; >= 7.2.0, <= 7.2.3; >= 7.0.0, <= 7.0.9; 6.4; 6.2

References

https://fortiguard.com/psirt/FG-IR-23-221Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-221Vendor Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-427837.5A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through CVE-2023-427849.8An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 a CVE-2023-427856.5A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versio CVE-2023-427866.5A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versio CVE-2023-427876.5A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiA CVE-2023-427886.7An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & Forti CVE-2023-427899.8A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fort CVE-2023-42797.5This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker CVE-2023-427908.1A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.CVE-2023-427918.8A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 an CVE-2023-427926.5Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some CVE-2023-427939.8In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible