CVE-2023-26209 - OpenCVE

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fortinet	Fortideceptor

Configuration 1 [-]

cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fortiguard.com/psirt/FG-IR-20-078

History

No history.

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2023-03-09T14:55:17.873Z

Updated: 2024-08-02T11:46:23.307Z

Reserved: 2023-02-20T15:09:20.636Z

Link: CVE-2023-26209

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-03-09T15:15:09.720

Modified: 2023-11-07T04:09:30.447

Link: CVE-2023-26209

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26209", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2023-02-20T15:09:20.636Z", "datePublished": "2023-03-09T14:55:17.873Z", "dateUpdated": "2024-08-02T11:46:23.307Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiDeceptor", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "3.1.0", "lessThanOrEqual": "3.1.1", "status": "affected"}, {"versionType": "semver", "version": "3.0.0", "lessThanOrEqual": "3.0.2", "status": "affected"}, {"version": "2.1.0", "status": "affected"}, {"version": "2.0.0", "status": "affected"}, {"version": "1.1.0", "status": "affected"}, {"versionType": "semver", "version": "1.0.0", "lessThanOrEqual": "1.0.1", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending\u00a0numerous HTTP requests to the login form."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2023-03-09T14:55:17.873Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-307", "description": "Denial of service", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:X"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiAuthenticator\u00a0version 6.5.0\u00a0or above,\nPlease upgrade to FortiDeceptor\u00a0version 3.2.0\u00a0or above.\nPlease upgrade to FortiMail\u00a0version 6.4.1 or above,\r\nPlease upgrade to FortiMail version 6.2.5\u00a0or above,\r\nPlease upgrade to FortiMail version 6.0.10\u00a0or above."}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-20-078", "url": "https://fortiguard.com/psirt/FG-IR-20-078"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.307Z"}, "title": "CVE Program Container", "references": [{"name": "https://fortiguard.com/psirt/FG-IR-20-078", "url": "https://fortiguard.com/psirt/FG-IR-20-078", "tags": ["x_transferred"]}]}]}}