Paper/Archive/CVE-2024-50563

CVE-2024-50563

Fortinet FortiAnalyzer — A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Clou…

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.4.474 × 209.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.

Affected

ProductAffectedFixed inSource

FortiAnalyzer7.6.0 – 7.6.1–CNA

FortiAnalyzer7.4.1 – 7.4.3–CNA

FortiManager7.6.0 – 7.6.1–CNA

FortiManager7.4.1 – 7.4.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)6.7CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reffortiguard.fortinet.com/psirt/FG-IR-24-221