Lucene search

FortinetCVE-2024-45323

HistorySep 10, 2024 - 3:15 p.m.

CVE-2024-45323

2024-09-1015:15:18

CWE-284

fortinet

web.nvd.nist.gov

access control

fortiedr manager

api permissions

backend logs

organization.

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R

AI Score

6.5

Confidence

Low

EPSS

Percentile

9.6%

JSON

An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include information related to other organizations.

Affected configurations

Nvd

Node

fortinetfortiedrmanagerRange6.2.0–6.2.2

fortinetfortiedrmanagerMatch6.0.1

VendorProductVersionCPE
fortinetfortiedrmanager*cpe:2.3:a:fortinet:fortiedrmanager:*:*:*:*:*:*:*:*
fortinetfortiedrmanager6.0.1cpe:2.3:a:fortinet:fortiedrmanager:6.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiedrmanager	*	cpe:2.3:a:fortinet:fortiedrmanager::::::::
fortinet	fortiedrmanager	6.0.1	cpe:2.3:a:fortinet:fortiedrmanager:6.0.1:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiEDR Manager",
    "cpes": [
      "cpe:2.3:a:fortinet:fortiedrmanager:6.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiedrmanager:6.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiedrmanager:6.0.1:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.1",
        "status": "affected"
      },
      {
        "version": "6.0.1",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.fortinet.com/psirt/FG-IR-24-371

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R

AI Score

6.5

Confidence

Low

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-45323