PT-2024-5558 · Fortinet · Fortiaiops

Published 2024-07-09 · Updated 2026-01-09 · CVE-2024-27783

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions FortiAIOps version 2.0.0

Description The issue is related to multiple cross-site request forgery (CSRF) vulnerabilities in the graphical user interface of FortiAIOps, which may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user. This can be achieved by tricking the victim into executing malicious GET requests, effectively allowing the attacker to send specially crafted harmful GET requests.

Recommendations For FortiAIOps version 2.0.0, consider disabling the vulnerable graphical user interface components until a patch is available to prevent exploitation of the CSRF vulnerabilities. Restrict access to the interface to minimize the risk of remote attackers sending malicious GET requests. Avoid using the interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-06237

CVE-2024-27783

Affected Products

Fortiaiops

References · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-24-070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27783 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27783 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06237 · Security Note
• https://t.me/cvedetector/374 · Telegram Post
• https://t.me/cveNotify/148245 · Telegram Post
• https://twitter.com/CVEnew/status/1810700134579151143 · Twitter Post