CVE-2024-33506
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned
Severity
Low 3.1
CVSS 3.1
Exploited
Not listed
EPSS
0.004
38.2th percentile
Discovered by
Vendor
Vendor advisory field
Published
Oct 8, 2024
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain (ADOM) to access device summary of unauthorized ADOMs via crafted HTTP requests.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiManager | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiManager
Credit
Internally discovered and reported by Leslie Zhou of Fortinet Vulnerability Research team.
Vendor remediation
Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above