PT-2024-8522 · Fortinet · Fortios+2

Published 2024-11-12 · Updated 2025-01-17 · CVE-2024-33510

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.4.4 FortiProxy versions prior to 7.4.4 FortiSASE version 24.2.b and earlier

Description The issue is related to an improper neutralization of special elements in output used by a downstream component, which may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests. This can be exploited through the SSL-VPN web user interface.

Recommendations For FortiOS versions prior to 7.4.4, update to version 7.4.4 or later to resolve the issue. For FortiProxy versions prior to 7.4.4, update to version 7.4.4 or later to resolve the issue. For FortiSASE version 24.2.b and earlier, update to a version later than 24.2.b to resolve the issue. As a temporary workaround, consider restricting access to the SSL-VPN web user interface to minimize the risk of exploitation.

Fix

Special Elements Injection

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-74

CWE-358

Related Identifiers

BDU:2024-10082

CVE-2024-33510

Affected Products

Fortios

Fortiproxy

Fortisase

References · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-24-033 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33510 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-33510 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33510 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10082 · Security Note
• https://twitter.com/VulmonFeeds/status/1856525281193755095 · Twitter Post
• https://twitter.com/CVEnew/status/1856828060907315629 · Twitter Post
• https://fortiguard.com/psirt/FG-IR-24-033 · Note