Lucene search
HistoryJul 09, 2024 - 4:15 p.m.
CVE-2024-23663
cve-2024-23663
improper access control
fortiextender
user privilege escalation
http request crafted
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
20.0%
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.
Affected configurations
Node
fortinetfortiextender_firmwareRange4.1.1–4.1.9
ORfortinetfortiextender_firmwareRange4.2.0–4.2.6
ORfortinetfortiextender_firmwareRange7.0.0–7.0.4
ORfortinetfortiextender_firmwareRange7.2.0–7.2.4
ORfortinetfortiextender_firmwareRange7.4.0–7.4.2
ORfortinetfortiextender_firmwareMatch5.3.2
fortinetfortiextenderMatch-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fortinet | fortiextender_firmware | * | cpe:2.3:o:fortinet:fortiextender_firmware:*:*:*:*:*:*:*:* |
| fortinet | fortiextender_firmware | 5.3.2 | cpe:2.3:o:fortinet:fortiextender_firmware:5.3.2:*:*:*:*:*:*:* |
| fortinet | fortiextender | - | cpe:2.3:h:fortinet:fortiextender:-:*:*:*:*:*:*:* |
References
Related
vulnrichment
vulnrichment
CVE-2024-23663
2024-07-09 15:33:31
cvelist
cvelist
CVE-2024-23663
2024-07-09 15:33:31
cve
cve
CVE-2024-23663
2024-07-09 16:15:04
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
20.0%
Related for NVD:CVE-2024-23663