What’s Vulnerable › Vulnerabilities

CVE-2023-48783

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-10 · updated 2026-06-17
• Weakness: CWE-639

Description

An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.

Affected products

• Fortinet FortiPortal: from 5.3.0 through 5.3.8; from 6.0.0 through 6.0.14; from 7.0.0 before 7.0.7; from 7.2.0 before 7.2.2 — fixed in 7.0.7, 7.2.2

How to fix

Upgrade to a fixed version: Fortinet FortiPortal 7.0.7, 7.2.2. Check the vendor advisory for mitigations.

References

• https://fortiguard.com/psirt/FG-IR-23-408
• https://fortiguard.com/psirt/FG-IR-23-408

Get alerted when CVE-2023-48783 or the next vulnerability affects your stack