Lucene search

FortinetVULNRICHMENT:CVE-2024-23105

HistoryMay 14, 2024 - 4:19 p.m.

CVE-2024-23105

2024-05-1416:19:14

CWE-348

fortinet

github.com

fortinet

fortiportal

less trusted source

vulnerability

bypass

ip protection

crafted packets

http

https

unauthenticated

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

19.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:fortinet:fortiportal:7.0.0:*:*:*:*:*:*:*"
    ],
    "vendor": "fortinet",
    "product": "fortiportal",
    "versions": [
      {
        "status": "affected",
        "version": "7.0.0",
        "versionType": "custom",
        "lessThanOrEqual": "7.0.6"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:fortinet:fortiportal:7.2.0:*:*:*:*:*:*:*"
    ],
    "vendor": "fortinet",
    "product": "fortiportal",
    "versions": [
      {
        "status": "affected",
        "version": "7.2.0",
        "versionType": "custom",
        "lessThanOrEqual": "7.2.1"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

fortiguard.com/psirt/FG-IR-24-021

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

19.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-23105