CVE-2024-23664
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an ar
Severity
Medium 5.8
CVSS 3.1
Exploited
Not listed
EPSS
0.003
28.4th percentile
Discovered by
Third party
Vendor advisory field
Published
Jun 3, 2024
Assigned by fortinet
Description
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.
Weakness: CWE-601
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAuthenticator | Identity / IAM / MFA | cna-assigner |
Vendor-reported products (4)
- Fortinet · FortiAuthenticator
- fortinet · fortiauthenticator
- fortinet · fortiauthenticator
- fortinet · fortiauthenticator
Credit
Fortinet is pleased to thank MOD from Cheops Cyberdefense for reporting this vulnerability under responsible disclosure.
Vendor remediation
Please upgrade to FortiAuthenticator version 6.6.1 or above Please upgrade to FortiAuthenticator version 6.5.4 or above