PT-2024-4056 · Fortinet · Fortiweb

Published

2024-01-19

·

Updated

2024-12-17

·

CVE-2024-23665

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.4.2 and below FortiWeb versions 7.2.7 and below FortiWeb versions 7.0.10 and below FortiWeb versions 6.4.3 and below FortiWeb versions 6.3.23 and below
Description: The issue is related to improper authorization vulnerabilities in FortiWeb, which may allow an authenticated attacker to perform unauthorized ADOM operations via crafted requests. This can potentially enable a remote attacker to read, modify, or delete data by sending specially crafted requests.
Recommendations: For FortiWeb versions 7.4.2 and below, update to a version above 7.4.2 to resolve the issue. For FortiWeb versions 7.2.7 and below, update to a version above 7.2.7 to resolve the issue. For FortiWeb versions 7.0.10 and below, update to a version above 7.0.10 to resolve the issue. For FortiWeb versions 6.4.3 and below, update to a version above 6.4.3 to resolve the issue. For FortiWeb versions 6.3.23 and below, update to a version above 6.3.23 to resolve the issue. As a temporary workaround, consider restricting access to ADOM operations until a patch is available.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2024-04501
CVE-2024-23665

Affected Products

Fortiweb