Paper/Archive/CVE-2024-55594

CVE-2024-55594

Fortinet FortiWeb — An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 44.6.446 × 208.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.

Affected

ProductAffectedFixed inSource

FortiWeb7.4.0 – 7.4.6–CNA

FortiWeb7.2.0 – 7.2.10–CNA

FortiWeb7.0.0 – 7.0.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)5.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reffortiguard.fortinet.com/psirt/FG-IR-23-115