CVE-2023-27998 Information disclosure in FortiPresence
Unauthenticated attackers can access sensitive information by navigating to specific HTTP paths due to missing custom error pages in FortiPresence.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27998?
CVE-2023-27998 is a medium-severity vulnerability in Fortinet FortiPresence, published on 13 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated attacker with the ability to navigate to the login GUI to gain sensitive information via navigating to specific HTTP(s) paths.
Which versions are affected by CVE-2023-27998?
It affects 1 product.
Products include Fortinet Fortipresence.
How do I fix CVE-2023-27998?
No fix has been published for CVE-2023-27998 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27998 being exploited?
There is no known exploitation of CVE-2023-27998 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiPresence
Sources
Also known as GHSA-7pp3-x5h4-fx5v.