CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 6CVE-2024-47575 – Fortinet FortiManager Missing Authentication Vulnerability
https://notcve.org/view.php?id=CVE-2024-47575
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests. A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests. Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. • https://github.com/hazesecurity/CVE-2024-47575 https://github.com/HazeLook/CVE-2024-47575 https://github.com/maybelookis/CVE-2024-47575 https://github.com/zgimszhd61/CVE-2024-47575-POC https://github.com/krmxd/CVE-2024-47575 https://github.com/groshi/CVE-2024-47575-POC https://fortiguard.fortinet.com/psirt/FG-IR-24-423 • CWE-306: Missing Authentication for Critical Function •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-33506
https://notcve.org/view.php?id=CVE-2024-33506
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain (ADOM) to access device summary of unauthorized ADOMs via crafted HTTP requests. • https://fortiguard.fortinet.com/psirt/FG-IR-23-472 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2023-44254
https://notcve.org/view.php?id=CVE-2023-44254
An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager version 7.4.1 and before 7.2.5 may allow a remote attacker with low privileges to read sensitive data via a crafted HTTP request. Una vulnerabilidad de omisión de autorización a través de una clave controlada por el usuario [CWE-639] en FortiAnalyzer versión 7.4.1 y anteriores a 7.2.5 y FortiManager versión 7.4.1 y anteriores a 7.2.5 puede permitir que un atacante remoto con privilegios bajos lea datos confidenciales a través de una solicitud HTTP manipulada específicamente. • https://fortiguard.com/psirt/FG-IR-23-204 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21757
https://notcve.org/view.php?id=CVE-2024-21757
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup. • https://fortiguard.fortinet.com/psirt/FG-IR-23-467 • CWE-620: Unverified Password Change •
CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2023-47542
https://notcve.org/view.php?id=CVE-2023-47542
A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates. Una neutralización inadecuada de elementos especiales utilizados en un motor de plantillas [CWE-1336] en FortiManager versiones 7.4.1 e inferiores, versiones 7.2.4 e inferiores, y 7.0.10 e inferiores permite al atacante ejecutar código o comandos no autorizados a través de plantillas especialmente manipuladas. • https://fortiguard.com/psirt/FG-IR-23-419 • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •