Fortinet FortiManager/FortiAnalyzer up to 6.4.14/7.0.11/7.2.4/7.4.1 Requests client-side enforcement of server-side security

Summaryinfo

A vulnerability was found in Fortinet FortiManager and FortiAnalyzer up to 6.4.14/7.0.11/7.2.4/7.4.1 and classified as critical. This affects an unknown function of the component Requests Handler. Such manipulation leads to client-side enforcement of server-side security. This vulnerability is traded as CVE-2024-23666. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Fortinet FortiManager and FortiAnalyzer up to 6.4.14/7.0.11/7.2.4/7.4.1. Affected by this issue is an unknown code of the component Requests Handler. The manipulation with an unknown input leads to a client-side enforcement of server-side security vulnerability. Using CWE to declare the problem leads to CWE-602. The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

The advisory is shared for download at fortiguard.fortinet.com. This vulnerability is handled as CVE-2024-23666 since 01/19/2024. The exploitation is known to be difficult. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Fortinet

Name

• FortiAnalyzer
• FortiManager

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 6.4.11
• 6.4.12
• 6.4.13
• 6.4.14
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.4.0
• 7.4.1

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion