CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://fortiguard.com/psirt/FG-IR-23-085	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortisiem::::::::
	cpe:2.3:a:fortinet:fortisiem::::::::
	cpe:2.3:a:fortinet:fortisiem::::::::
	cpe:2.3:a:fortinet:fortisiem:7.0.0:::::::*

History

15 Jul 2025, 19:41

Type	Values Removed	Values Added
Summary		(es) Un Path Traversal relativo en las versiones 7.0.0, 6.7.0 a 6.7.2, 6.6.0 a 6.6.3, 6.5.1 y 6.5.0 de Fortinet FortiSIEM permite a un atacante escalar privilegios mediante la carga de ciertos elementos de la GUI.
References	~~() https://fortiguard.com/psirt/FG-IR-23-085 -~~	() https://fortiguard.com/psirt/FG-IR-23-085 - Vendor Advisory
CPE		cpe:2.3:a:fortinet:fortisiem:7.0.0:::::::* cpe:2.3:a:fortinet:fortisiem::::::::
First Time		Fortinet fortisiem Fortinet

02 Apr 2025, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-02 08:15

Updated : 2025-07-15 19:41

NVD link : CVE-2023-40714

Mitre link : CVE-2023-40714

CVE.ORG link : CVE-2023-40714

JSON object : View

Products Affected

fortinet

fortisiem

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2023-40714", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-04-02T08:15:13.530", "references": [{"url": "https://fortiguard.com/psirt/FG-IR-23-085", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements"}, {"lang": "es", "value": "Un Path Traversal relativo en las versiones 7.0.0, 6.7.0 a 6.7.2, 6.6.0 a 6.6.3, 6.5.1 y 6.5.0 de Fortinet FortiSIEM permite a un atacante escalar privilegios mediante la carga de ciertos elementos de la GUI."}], "lastModified": "2025-07-15T19:41:08.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C994856C-4130-466C-AF0E-B82E170E1781", "versionEndIncluding": "6.5.1", "versionStartIncluding": "6.4.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB301503-0ECB-4D21-B341-ACF0F302CF85", "versionEndIncluding": "6.6.3", "versionStartIncluding": "6.6.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "793796C9-C300-4737-8275-52299FACAC21", "versionEndIncluding": "6.7.3", "versionStartIncluding": "6.7.0"}, {"criteria": "cpe:2.3:a:fortinet:fortisiem:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAB28BA6-45B6-422B-9901-300B6024F703"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}