CVE-2024-45323
An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissi
Severity
Medium 4.6
CVSS 3.1
Exploited
Not listed
EPSS
0.004
30.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Sep 10, 2024
Assigned by fortinet
Description
An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include information related to other organizations.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiEDR | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiEDR Manager
Credit
External
Vendor remediation
Please upgrade to FortiEDR Manager version 6.2.3 or above Please upgrade to FortiEDR Manager version 6.0.2 or above