CVE-2024-23112
Assigner: fortinet
Published: 2024-03-12T15:09:17.877Z
State: PUBLISHED
affected: vendor: Fortinet
product: FortiOS
defaultStatus: unaffected
versions: versionType: semver
version: 7.4.0
lessThanOrEqual: 7.4.1
status: affected
versionType: semver
version: 7.2.0
lessThanOrEqual: 7.2.6
status: affected
versionType: semver
version: 7.0.1
lessThanOrEqual: 7.0.13
status: affected
versionType: semver
version: 6.4.7
lessThanOrEqual: 6.4.14
status: affected
vendor: Fortinet
product: FortiProxy
defaultStatus: unaffected
versions: versionType: semver
version: 7.4.0
lessThanOrEqual: 7.4.2
status: affected
versionType: semver
version: 7.2.0
lessThanOrEqual: 7.2.8
status: affected
versionType: semver
version: 7.0.0
lessThanOrEqual: 7.0.14
status: affected
descriptions: value: An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.
problemTypes: descriptions: cweId: CWE-639
description: Improper access control
type: CWE
metrics: format: CVSS
cvssV3_1: version: 3.1
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
solutions: value: Please upgrade to FortiOS version 7.4.2 or above 
Please upgrade to FortiOS version 7.2.7 or above 
Please upgrade to FortiOS version 7.0.14 or above 
Please upgrade to FortiOS version 6.4.15 or above 
Please upgrade to FortiProxy version 7.4.3 or above 
Please upgrade to FortiProxy version 7.2.9 or above 
Please upgrade to FortiProxy version 7.0.15 or above