43 results (0.004 seconds)

CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 6

CVE-2024-47575 – Fortinet FortiManager Missing Authentication Vulnerability

https://notcve.org/view.php?id=CVE-2024-47575

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests. Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. • https://github.com/hazesecurity/CVE-2024-47575 https://github.com/HazeLook/CVE-2024-47575 https://github.com/maybelookis/CVE-2024-47575 https://github.com/zgimszhd61/CVE-2024-47575-POC https://github.com/krmxd/CVE-2024-47575 https://github.com/groshi/CVE-2024-47575-POC https://fortiguard.fortinet.com/psirt/FG-IR-24-423 • CWE-306: Missing Authentication for Critical Function •

CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0

CVE-2023-44254

https://notcve.org/view.php?id=CVE-2023-44254

An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request. Una vulnerabilidad de omisión de autorización a través de una clave controlada por el usuario [CWE-639] en FortiAnalyzer versión 7.4.1 y anteriores a 7.2.5 y FortiManager versión 7.4.1 y anteriores a 7.2.5 puede permitir que un atacante remoto con privilegios bajos lea datos confidenciales a través de una solicitud HTTP manipulada específicamente. • https://fortiguard.com/psirt/FG-IR-23-204 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 6.7EPSS: 0%CPEs: 11EXPL: 0

CVE-2023-41842

https://notcve.org/view.php?id=CVE-2023-41842

A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiManager version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.3 and before 7.0.10, Fortinet FortiAnalyzer-BigData before 7.2.5 and Fortinet FortiPortal version 6.0 all versions and version 5.3 all versions allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments. Un uso de vulnerabilidad de cadena de formato controlada externamente [CWE-134] en Fortinet FortiManager versión 7.4.0 a 7.4.1, versión 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer versión 7.4.0 a 7.4.1 , versión 7.2.0 a 7.2.3 y anteriores a 7.0.10, Fortinet FortiAnalyzer-BigData anterior a 7.2.5 y Fortinet FortiPortal versión 6.0 todas las versiones y la versión 5.3 todas las versiones permite a un atacante privilegiado ejecutar código o comandos no autorizados a través de argumentos de comando especialmente manipulados. • https://fortiguard.com/psirt/FG-IR-23-304 • CWE-134: Use of Externally-Controlled Format String •

CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0

CVE-2023-36554

https://notcve.org/view.php?id=CVE-2023-36554

A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Un control de acceso inadecuado en Fortinet FortiManager versión 7.4.0, versión 7.2.0 a 7.2.3, versión 7.0.0 a 7.0.10, versión 6.4.0 a 6.4.13, 6.2 todas las versiones permite a un atacante ejecutar código o comandos no autorizados a través de solicitudes HTTP especialmente manipuladas. • https://fortiguard.com/psirt/FG-IR-23-103 • CWE-284: Improper Access Control •

CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0

CVE-2023-42791

https://notcve.org/view.php?id=CVE-2023-42791

A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests. Un path traversal relativo en Fortinet FortiManager versión 7.4.0 y 7.2.0 a 7.2.3 y 7.0.0 a 7.0.8 y 6.4.0 a 6.4.12 y 6.2.0 a 6.2.11 permite al atacante ejecutar código no autorizado o comandos a través de solicitudes HTTP manipuladas. • https://fortiguard.com/psirt/FG-IR-23-189 • CWE-23: Relative Path Traversal •