CVE-2024-23666

Published: Nov 12, 2024Modified: Jan 21, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

Affected (10)

Products: Fortinet: Fortianalyzer, Fortianalyzer Big Data, Fortimanager

Fortinet

3 products

Fortianalyzer

Fortianalyzer Big Data

Fortimanager

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.4.0 to 6.4.15
Fortinet Fortianalyzer	From 7.0.0 to 7.0.13
Fortinet Fortianalyzer	From 7.2.0 to 7.2.6
Fortinet Fortianalyzer	From 7.4.0 to 7.4.3
Fortinet Fortianalyzer Big Data	From 6.2.1 to 7.2.7
Fortinet Fortianalyzer Big Data	Version 7.4.0
Fortinet Fortimanager	From 6.4.0 to 6.4.15
Fortinet Fortimanager	From 7.0.0 to 7.0.13
Fortinet Fortimanager	From 7.2.0 to 7.2.6
Fortinet Fortimanager	From 7.4.0 to 7.4.3

Related CWEs

CWE-602

Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-23-396

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.