CVE-2024-40593
A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4
Description
A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.
Weakness: CWE-320
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAnalyzer | SIEM & Log Management | cna-assigner |
| Fortinet | FortiManager | Network & Security Management | cna-assigner |
| Fortinet | FortiOS | Firewall / NGFW | cna-assigner |
| Fortinet | FortiPortal | Network & Security Management | cna-assigner |
Vendor-reported affected versions (4)
- Fortinet · FortiAnalyzer
- Fortinet · FortiPortal
- Fortinet · FortiOS
- Fortinet · FortiManager
Vendor remediation
Upgrade to FortiAnalyzer version 7.6.0 or above Upgrade to FortiAnalyzer version 7.4.3 or above Upgrade to FortiAnalyzer version 7.2.6 or above Upgrade to FortiPortal version 7.0.0 or above Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.5 or above Upgrade to FortiOS version 7.2.8 or above Upgrade to FortiOS version 7.0.15 or above Upgrade to FortiManager version 7.4.3 or above Upgrade to FortiManager version 7.2.6 or above