CVE-2023-42787 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-42787MEDIUM

Fortinet FortiAnalyzer — A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and For…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0137   69.8     —

AFFECTED
  Product                Versions  Fixed
  FortiAnalyzer          7.4.0 –   —
  FortiManager           7.4.0 –   —
  FortiAnalyzer-BigData  7.2.0 –   —
  FortiAnalyzer Cloud    7.0.1 –   —

TIMELINE
  Sep 14  Reserved by fortinet
  Oct 10  Published (CNA: fortinet)
  Aug 12  EXPLOIT PUBLISHED — CVE-2023-42787 (Fortinet FortiAnalyzer). Public exploit reference added.
  Aug 12  RESCORED — CVE-2023-42787 (Fortinet FortiAnalyzer). CVSS 6.2 → 6.5 (NVD).

CWE-602 · CNA: fortinet · CVSS v3.1 · 2 references · NVD status: Modified

Description

A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
September 14, 2023	Reserved	Reserved by fortinet
October 10, 2023	Published	Published (CNA: fortinet)
August 12, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-42787 (Fortinet FortiAnalyzer). Public exploit reference added.
August 12, 2026	RESCORED	RESCORED — CVE-2023-42787 (Fortinet FortiAnalyzer). CVSS 6.2 → 6.5 (NVD).

Affected

Affected products and packages — 4 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Fortinet	FortiAnalyzer	—	7.4.0	—
Fortinet	FortiManager	—	7.4.0	—
Fortinet	FortiAnalyzer-BigData	—	7.2.0	—
Fortinet	FortiAnalyzer Cloud	—	7.0.1	—

Weaknesses

CWE-602

References (2)

https://fortiguard.com/psirt/FG-IR-23-187 [Vendor Advisory]
https://github.com/orangecertcc/security-research/security/advisories/GHSA-q5pq-8666-j8fr [Exploit, Third Party Advisory]

Authoritative record: CVE-2023-42787 at cve.org

Vendors: fortinet

Weaknesses: CWE-602

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-42787 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.