CVE-2023-44252 Auth bypass in FortiWAN
An authenticated attacker can escalate privileges in FortiWAN by sending crafted JWT tokens via HTTP or HTTPS requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-44252?
CVE-2023-44252 is a high-severity authentication bypass vulnerability in Fortinet FortiWAN, published on 13 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values.
Weakness: CWE-287
Which versions are affected by CVE-2023-44252?
It affects 1 product.
Products include Fortinet Fortiwan.
How do I fix CVE-2023-44252?
No fix has been published for CVE-2023-44252 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-44252 being exploited?
There is no known exploitation of CVE-2023-44252 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiWAN
Sources
Also known as GHSA-mjfm-wh8j-9fgg.