CVE-2024-55594
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthor
Description
An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.
Weakness: CWE-228
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiWeb | Web & Application Security | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiWeb
Credit
Fortinet is pleased to thank Nikola Kojic, RAS-IT | https://www.ras-it.rs , and Qi Wang(@eki) and Jianjun Chen from Tsinghua University & Zhongguancun Lab for reporting these vulnerabilities under responsible disclosure.
Vendor remediation
Please upgrade to FortiWeb version 7.6.0 or above Please upgrade to FortiWeb version 7.4.7 or above