CVE-2024-23663
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via
Severity
High 8.1
CVSS 3.1
Exploited
Not listed
EPSS
0.006
49.3th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jul 9, 2024
Assigned by fortinet
Description
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiExtender | Routing & Switching | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiExtender
- fortinet · fortiextender
Credit
Discovered in the frame of internal audit by 3rd party company
Vendor remediation
Please upgrade to FortiExtender version 7.4.3 or above Please upgrade to FortiExtender version 7.2.5 or above Please upgrade to FortiExtender version 7.0.5 or above