CVE-2023-50180 Information disclosure in FortiADC

Medium 5.2 Published 14 May 2024 Updated 2 Aug 2024

A read-only admin can view sensitive data belonging to other administrators in FortiADC, exposing system information to unauthorized users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-50180?

CVE-2023-50180 is a medium-severity vulnerability in Fortinet FortiADC, published on 14 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.

Weakness: CWE-497

Which versions are affected by CVE-2023-50180?

It affects 1 product.

Products include Fortinet Fortiadc.

How do I fix CVE-2023-50180?

No fix has been published for CVE-2023-50180 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-50180 being exploited?

There is no known exploitation of CVE-2023-50180 in the wild and no public exploit code.

Sources

Also known as GHSA-x49q-j7fx-rrwj.