CVE-2024-45323
An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissi
Severity
Medium 4.6
CVSS 3.1
Exploited
Not listed
EPSS
0.004
29.0th percentile
Discovered by
Not disclosed
Published
Sep 10, 2024
Assigned by fortinet
Description
An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared environment context an authenticated admin with REST API permissions in his profile and restricted to a specific organization to access backend logs that include information related to other organizations.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiEDR | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiEDR Manager
Vendor remediation
Please upgrade to FortiEDR Manager version 6.2.3 or above Please upgrade to FortiEDR Manager version 6.0.2 or above