Skip to content
OpenAdvisories
High · 7.1 Public exploit CVE-2024-23666 EUVD-2024-21139GHSA-jwm4-jq46-9g26

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.…

Published Nov 12, 2024 · Updated Nov 13, 2024 · Assigned by fortinet

Vendor: Fortinet Product: FortiAnalyzer Product: FortiManager Category: Network devices

Description

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData
at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

Affected products

VendorProductAffectedFixed
Fortinet FortiManager 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.4, 7.0.0 – ≤ 7.0.11, 6.4.0 – ≤ 6.4.14 —
Fortinet FortiAnalyzer 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.4, 7.0.0 – ≤ 7.0.11, 6.4.0 – ≤ 6.4.14 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References