CVE-2024-23666 — Fortinet / FortiManager

Description (CNA)

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

Affected (CNA)

Vendor / product	Versions
Fortinet / FortiManager	affected 7.4.0 through 7.4.1; affected 7.2.0 through 7.2.4; affected 7.0.0 through 7.0.11; affected 6.4.0 through 6.4.14
Fortinet / FortiAnalyzer	affected 7.4.0 through 7.4.1; affected 7.2.0 through 7.2.4; affected 7.0.0 through 7.0.11; affected 6.4.0 through 6.4.14

CWE

CWE-602

References

https://fortiguard.fortinet.com/psirt/FG-IR-23-396

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.