#VU100782 Client-Side Enforcement of Server-Side Security in FortiAnalyzer and FortiAnalyzer BigData - CVE-2024-23666

Vulnerability identifier: #VU100782

Vulnerability risk: Medium

CVSSv4.0: 6.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2024-23666

CWE-ID: CWE-602

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
FortiAnalyzer
Server applications / IDS/IPS systems, Firewalls and proxy servers
FortiAnalyzer BigData
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Fortinet, Inc

Description

The vulnerability allows a remote user to perform otherwise restricted actions.

The vulnerability exists due to improper permissions management. A remote user with at least read-only permission to execute sensitive operations via crafted requests.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FortiAnalyzer: 6.4.0 - 6.4.14, 7.0.0 - 7.0.12, 7.2.0 - 7.2.5, 7.4.0 - 7.4.2

FortiAnalyzer BigData: 6.2.1 - 7.4.0

---

External links
https://fortiguard.fortinet.com/psirt/FG-IR-23-396

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.