← Back

CVE-2024-35277

nvd nist
Published: Jan 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets

Affected (7)

Fortinet
2 products
Fortimanager
Fortimanager Cloud
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortimanager
From 6.4.0 to 6.4.15
Fortimanager
From 7.0.0 to 7.0.13
Fortimanager
From 7.2.0 to 7.2.6
Fortimanager
From 7.4.0 to 7.4.3
Fortinet
Fortimanager Cloud
From 7.0.1 to 7.0.13
Fortimanager Cloud
From 7.2.1 to 7.2.7
Fortimanager Cloud
From 7.4.1 to 7.4.3

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.