CVE-2024-23666

Description

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

Reserved 2024-01-19 | Published 2024-11-12 | Updated 2024-11-13 | Assigner fortinet

Problem types

Improper access control

Product status

Default status
unaffected

7.4.0
affected

7.2.0
affected

7.0.0
affected

6.4.0
affected

Default status
unaffected

7.4.0
affected

7.2.0
affected

7.0.0
affected

6.4.0
affected

References

fortiguard.fortinet.com/psirt/FG-IR-23-396

cve.org (CVE-2024-23666)

nvd.nist.gov (CVE-2024-23666)

Download JSON