CVEvulnerability

CVE-2024-23666

8.8 HIGH Published 2024-11-12 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-11-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-602

Description

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

Affected configurations

• fortinet fortianalyzer (>= 6.4.0 < 6.4.15) • fortinet fortianalyzer (>= 7.0.0 < 7.0.13) • fortinet fortianalyzer (>= 7.2.0 < 7.2.6) • fortinet fortianalyzer (>= 7.4.0 < 7.4.3) • fortinet fortianalyzer big data (>= 6.2.1 < 7.2.7) • fortinet fortianalyzer big data 7.4.0 • fortinet fortimanager (>= 6.4.0 < 6.4.15) • fortinet fortimanager (>= 7.0.0 < 7.0.13) • fortinet fortimanager (>= 7.2.0 < 7.2.6) • fortinet fortimanager (>= 7.4.0 < 7.4.3)

Related

Weakness · CWE (1)

  • CWE-602 Client-Side Enforcement of Server-Side Security weakness

References