CVE-2024-54020
A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update
Severity
Low 2.1
CVSS 3.1
Exploited
Not listed
EPSS
0.002
10.7th percentile
Discovered by
Vendor
Vendor advisory field
Published
May 28, 2025
Assigned by fortinet
Description
A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests.
Weakness: CWE-862
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiManager | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiManager
Credit
Internal
Vendor remediation
Please upgrade to FortiManager version 7.4.0 or above Please upgrade to FortiManager version 7.2.2 or above Please upgrade to FortiManager version 7.0.8 or above