Lucene search

FortinetCVE-2024-27783

HistoryJul 09, 2024 - 4:15 p.m.

CVE-2024-27783

2024-07-0916:15:05

CWE-352

fortinet

web.nvd.nist.gov

cross-site request forgery

fortiaiops

version 2.0.0

unauthenticated remote attacker

malicious get requests

cwe-352

arbitrary actions

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

24.8%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities [CWE-352] in FortiAIOps version 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests.

Affected configurations

Nvd

Node

fortinetfortiaiopsMatch2.0.0

VendorProductVersionCPE
fortinetfortiaiops2.0.0cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiaiops	2.0.0	cpe:2.3:a:fortinet:fortiaiops:2.0.0:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiAIOps",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "2.0.0",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.fortinet.com/psirt/FG-IR-24-070

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2024-27783