This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Fortinet fixes 9 vulnerabilities in various products
Fortinet fixes 9 vulnerabilities in various products. Individual products and their fixed versions: FortiSOAR - 7.4.4, 7.3.3 [1] FortiClientEMS Cloud - 7.2.5, 7.0.13 [2] FortiClientEMS - 7.2.5 [2][3] FortiClientLinux - 7.2.1, 7.0.12 [4] FortiClientMac - 7.2.5, 7.0.12 [4] FortiClientWindows - 7.2.3, 7.0.12 [4] FortiSandbox - 4.4.5, 4.2.7 [5] FortiAnalyzer - 7.4.1, 7.2.5 [6] FortiAnalyzer-BigData - 7.4.0, 7.2.6 [6] FortiManager - 7.4.1, 7.2.5 [6] FortiADC - 7.4.5 [7] FortiEDR Manager - 6.2.2 [8] FortiClientiOS - 7.4 [9]
An authenticated remote attacker can discover another user's password in FortiSOAR via a brute-force attack by sending specially crafted HTTP requests [1].
The vulnerability is present in product:
- FortiSOAR; >=7.4.0, <7.4.4; >=7, <7.3.3;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45327 at cve.org, NVD
- CWE-285: Improper Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An unauthenticated remote attacker can perform certain database operations without authorization in FortiClientEMS and FortiClientEMS Cloud [2].
The vulnerability is present in products:
- FortiClientEMS; >=7.2, <7.2.5; >=7, <7.0.13;
- FortiClientEMS Cloud; >=7.2, <7.2.5; >=7, <7.0.13;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
More information:
- CVE-2024-33508 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An authenticated remote attacker can read and delete arbitrary files from the system without authorization in FortiClientEMS [3].
The vulnerability is present in product:
- FortiClientEMS; >=1.2.2, <1.2.5; >=6, <7.2.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:H/RL:U/RC:C
More information:
- CVE-2024-21753 at cve.org, NVD
- CWE-23: Relative Path Traversal at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An unauthenticated remote attacker can view the communication between FortiClient and FortiGate without authorization in FortiClient [4].
The vulnerability is present in products:
- FortiClientLinux; >=7.2, <7.2.1; >=7, <7.0.12
- FortiClientMac; >=7.2, <7.2.5; >=7, <7.0.12
- FortiClientWindows; >=7.2, <7.2.3; >=7, <7.0.12
CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:C
More information:
- CVE-2024-31489 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An authenticated remote attacker with read privileges can access sensitive information without authorization in FortiSandbox by sending specially crafted HTTP requests [5].
The vulnerability is present in product:
- FortiSandbox; >=4.4.0, <4.4.5; >=3.1.5, <4.2.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X
More information:
- CVE-2024-31490 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An authenticated remote attacker can access information without authorization in FortiAnalyzer and FortiManager by sending specially crafted requests [6].
The vulnerability is present in products:
- FortiAnalyzer; >=7.4.0, <7.4.1, >=7.2.0, <7.2.5; >=7, >=7, <7.1; >=6.4, <6.5; >=6.2, <6.3;
- FortiManager; >=7.4.0, <7.4.1; >=7.2.0, <7.2.5; >=7, >=7, <7.1; >=6.4, <6.5; >=6.2, <6.3;
- FortiAnalyzer-BigData; >=7.2, <7.2.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:P/RL:X/RC:X
More information:
- CVE-2023-44254 at cve.org, NVD
- CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An unauthenticated remote attacker can, under certain circumstances, obtain a user's encrypted and signed initial cookie in FortiADC [7].
The vulnerability is present in product:
- FortiADC; >=7, <7.4.5; >=6, <6.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R
More information:
- CVE-2024-36511 at cve.org, NVD
- CWE-358: Improperly Implemented Security Check for Standard at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An authenticated remote attacker with administrator and REST API privileges can access log information from other organizations in FortiEDR Manager [8].
The vulnerability is present in product:
- FortiEDR Manager; >=6, <6.1; >=6.2, <6.2.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
More information:
- CVE-2024-45323 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
An unauthenticated physical attacker can access passwords in plain text form in FortiClientiOS [9].
The vulnerability is present in product:
- FortiClientiOS; >=6, <7; >6.2, <6.3; >=6.4, <6.5; >=7, <7.1; >=7.2, <7.3;
CVSS: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R
More information:
- CVE-2024-35282 at cve.org, NVD
- CWE-316: Cleartext Storage of Sensitive Information in Memory at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2024.
Links
- [1] https://fortiguard.fortinet.com/psirt/FG-IR-24-048
- [2] https://fortiguard.fortinet.com/psirt/FG-IR-24-123
- [3] https://fortiguard.fortinet.com/psirt/FG-IR-23-362
- [4] https://fortiguard.fortinet.com/psirt/FG-IR-22-282
- [5] https://www.fortiguard.com/psirt/FG-IR-24-051
- [6] https://www.fortiguard.com/psirt/FG-IR-23-204
- [7] https://fortiguard.fortinet.com/psirt/FG-IR-22-256
- [8] https://fortiguard.fortinet.com/psirt/FG-IR-24-371
- [9] https://fortiguard.fortinet.com/psirt/FG-IR-24-139
By CESNET, z.s.p.o. Martin Krajči on 18. 9. 2024.