Medium WID-SEC-2025-0088 11 CVEs

Fortinet FortiOS: Mehrere Schwachstellen

Published Jan 14, 2025 · Updated Jan 14, 2025 · de-DE

Vendor: Fortinet Product: FortiOS

Summary

Ein anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Fortinet FortiOS ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen und einen Spoofing-Angriff zu starten.

Product

FortiOS ist ein gehärtetes Betriebssystem für FortiGate Plattformen.

Vulnerabilities 11

High 7.5

CVE-2024-46670

An Out-of-bounds Read vulnerability [CWE-125] in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and belo…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Jan 14, 2025
High 7.1

CVE-2024-46668

An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4…

Fortinet FortiOS Network devices

Jan 14, 2025
Medium 6.4

CVE-2023-42785

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all vers…

Fortinet FortiOS Network devices

Jan 14, 2025
Medium 6.4

CVE-2023-42786

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all vers…

Fortinet FortiOS Network devices

Jan 14, 2025
Medium 6.4

CVE-2024-54021

An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in For…

Fortinet FortiOS FortiProxy Network devices

Jan 14, 2025
Medium 6.2

CVE-2024-36504

An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0…

Fortinet FortiOS Network devices

Jan 14, 2025
Medium 4.8

CVE-2024-46666

An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4…

Fortinet FortiOS Network devices

Jan 14, 2025
Medium 4.7

CVE-2023-46715

An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and versio…

Fortinet FortiOS FortiProxy Network devices

Jan 14, 2025
Low 3.5

CVE-2024-46665

An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may …

Fortinet FortiOS Network devices

Jan 14, 2025
Low 3.5

CVE-2024-52963

A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.…

Fortinet FortiOS FortiProxy FortiPAM Network devices

Jan 14, 2025
Low 3.2

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability [CWE-190] in version 7.4.4 and below, version 7.2.10 and below; FortiSA…

Fortinet FortiOS Network devices

Jan 14, 2025

Revision history

2025-01-14 #1
Initiale Fassung

References

FortiGuard PSIRT Advisory FG-IR-23-473 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-23-473
FortiGuard PSIRT Advisory FG-IR-24-326 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-326
FortiGuard PSIRT Advisory FG-IR-24-250 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-250
FortiGuard PSIRT Advisory FG-IR-24-219 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-219
FortiGuard PSIRT Advisory FG-IR-24-267 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-267
FortiGuard PSIRT Advisory FG-IR-24-266 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-266
FortiGuard PSIRT Advisory FG-IR-23-407 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-23-407
FortiGuard PSIRT Advisory FG-IR-23-293 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-23-293
FortiGuard PSIRT Advisory FG-IR-24-373 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-373
FortiGuard PSIRT Advisory FG-IR-24-282 vom 2025-01-14
https://www.fortiguard.com/psirt/FG-IR-24-282