CVE-2024-23112
Vulnerability from cvelistv5
Published
2024-03-12 15:09
Modified
2024-08-01 22:51
Severity
Summary
An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.
References
Source | URL | Tags |
---|---|---|
psirt@fortinet.com | https://fortiguard.com/psirt/FG-IR-24-013 | Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
Fortinet | FortiOS |
Fortinet | FortiProxy |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortios", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortios", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.2.6", "status": "affected", "version": "7.2.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortios", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.0.13", "status": "affected", "version": "7.0.1", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortios", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "6.4.14", "status": "affected", "version": "6.4.7", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortiproxy", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.4.2", "status": "affected", "version": "7.4.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortiproxy", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.2.8", "status": "affected", "version": "7.2.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "fortiproxy", "vendor": "fortinet", "versions": [ { "lessThanOrEqual": "7.0.14", "status": "affected", "version": "7.0.0", "versionType": "semver" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-23112", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-03-16T04:00:42.744773Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-25T15:56:14.854Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T22:51:11.269Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "https://fortiguard.com/psirt/FG-IR-24-013", "tags": [ "x_transferred" ], "url": "https://fortiguard.com/psirt/FG-IR-24-013" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "FortiOS", "vendor": "Fortinet", "versions": [ { "lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "semver" }, { "lessThanOrEqual": "7.2.6", "status": "affected", "version": "7.2.0", "versionType": "semver" }, { "lessThanOrEqual": "7.0.13", "status": "affected", "version": "7.0.1", "versionType": "semver" }, { "lessThanOrEqual": "6.4.14", "status": "affected", "version": "6.4.7", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "FortiProxy", "vendor": "Fortinet", "versions": [ { "lessThanOrEqual": "7.4.2", "status": "affected", "version": "7.4.0", "versionType": "semver" }, { "lessThanOrEqual": "7.2.8", "status": "affected", "version": "7.2.0", "versionType": "semver" }, { "lessThanOrEqual": "7.0.14", "status": "affected", "version": "7.0.0", "versionType": "semver" } ] } ], "descriptions": [ { "lang": "en", "value": "An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user\u2019s bookmark via URL manipulation." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-639", "description": "Improper access control", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-03-12T15:09:17.877Z", "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet" }, "references": [ { "name": "https://fortiguard.com/psirt/FG-IR-24-013", "url": "https://fortiguard.com/psirt/FG-IR-24-013" } ], "solutions": [ { "lang": "en", "value": "Please upgrade to FortiOS version 7.4.2 or above \nPlease upgrade to FortiOS version 7.2.7 or above \nPlease upgrade to FortiOS version 7.0.14 or above \nPlease upgrade to FortiOS version 6.4.15 or above \nPlease upgrade to FortiProxy version 7.4.3 or above \nPlease upgrade to FortiProxy version 7.2.9 or above \nPlease upgrade to FortiProxy version 7.0.15 or above \n" } ] } }, "cveMetadata": { "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "assignerShortName": "fortinet", "cveId": "CVE-2024-23112", "datePublished": "2024-03-12T15:09:17.877Z", "dateReserved": "2024-01-11T16:29:07.979Z", "dateUpdated": "2024-08-01T22:51:11.269Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-23112\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2024-03-12T15:15:49.090\",\"lastModified\":\"2024-03-15T14:51:58.497\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user\u2019s bookmark via URL manipulation.\"},{\"lang\":\"es\",\"value\":\"Una omisi\u00f3n de autorizaci\u00f3n a trav\u00e9s de una vulnerabilidad de clave controlada por el usuario [CWE-639] en FortiOS versi\u00f3n 7.4.0 a 7.4.1, 7.2.0 a 7.2.6, 7.0.1 a 7.0.13, 6.4.7 a 6.4.14, y FortiProxy versi\u00f3n 7.4.0 a 7.4.2, 7.2.0 a 7.2.8, 7.0.0 a 7.0.14 SSL-VPN puede permitir que un atacante autenticado obtenga acceso al marcador de otro usuario mediante manipulaci\u00f3n de URL.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4},{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndIncluding\":\"7.0.14\",\"matchCriteriaId\":\"94C6FBEA-B8B8-4A92-9CAF-F4A125577C3C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndIncluding\":\"7.2.8\",\"matchCriteriaId\":\"406F8C48-85CE-46AF-BE5C-0ED9E3E16A39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndIncluding\":\"7.4.2\",\"matchCriteriaId\":\"A8DD8789-6485-49E6-92D3-74004D9B6E9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.7\",\"versionEndIncluding\":\"6.4.14\",\"matchCriteriaId\":\"4841D40B-DA6E-4B4A-A698-8E23B3E40101\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.1\",\"versionEndIncluding\":\"7.0.13\",\"matchCriteriaId\":\"40193C91-DAF4-4A0D-9AA7-0D4DDE964488\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndIncluding\":\"7.2.6\",\"matchCriteriaId\":\"24D09A92-81EC-4003-B017-C67FC739EEBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndIncluding\":\"7.4.1\",\"matchCriteriaId\":\"2E2A5347-D536-4D43-A163-5B5A3AFE742C\"}]}]}],\"references\":[{\"url\":\"https://fortiguard.com/psirt/FG-IR-24-013\",\"source\":\"psirt@fortinet.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading...