diff --git a/2023/40xxx/CVE-2023-40356.json b/2023/40xxx/CVE-2023-40356.json
index aaed80d7f5a..ed2ae507d53 100644
--- a/2023/40xxx/CVE-2023-40356.json
+++ b/2023/40xxx/CVE-2023-40356.json
@@ -1,18 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-40356",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "responsible-disclosure@pingidentity.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target\u2019s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user\u2019s account if they have existing knowledge of the target user\u2019s first factor credential."
}
]
- }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-290 Authentication Bypass by Spoofing",
+ "cweId": "CWE-290"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Ping Identity",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "PingOne MFA Integration Kit for PingFederate",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "0",
+ "version_value": "2.3.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394",
+ "refsource": "MISC",
+ "name": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "work_around": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Disable the Prompt Users to Set Up MFA option in your PingOne MFA adapter configuration.
"
+ }
+ ],
+ "value": "Disable the Prompt Users to Set Up MFA option in your PingOne MFA adapter configuration."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2023/40xxx/CVE-2023-40702.json b/2023/40xxx/CVE-2023-40702.json
index 0caac4a910b..ed3582f09d5 100644
--- a/2023/40xxx/CVE-2023-40702.json
+++ b/2023/40xxx/CVE-2023-40702.json
@@ -1,18 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-40702",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "responsible-disclosure@pingidentity.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user\u2019s first-factor credentials."
}
]
- }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-290 Authentication Bypass by Spoofing",
+ "cweId": "CWE-290"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Ping Identity",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "PingOne MFA Integration Kit for PingFederate",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "0",
+ "version_value": "2.3.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394",
+ "refsource": "MISC",
+ "name": "https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.2.0"
+ },
+ "source": {
+ "discovery": "INTERNAL"
+ },
+ "work_around": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Disable the Allow Users to Skip MFA Setup in your PingOne MFA adapter configuration.
"
+ }
+ ],
+ "value": "Disable the Allow Users to Skip MFA Setup in your PingOne MFA adapter configuration."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2023/50xxx/CVE-2023-50178.json b/2023/50xxx/CVE-2023-50178.json
index b75fbd5b1e5..8d9f3eb0301 100644
--- a/2023/50xxx/CVE-2023-50178.json
+++ b/2023/50xxx/CVE-2023-50178.json
@@ -1,17 +1,107 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-50178",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure",
+ "cweId": "CWE-295"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiADC",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "7.1.0"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.2"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.2.0",
+ "version_value": "6.2.6"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.1.0",
+ "version_value": "6.1.6"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.0.0",
+ "version_value": "6.0.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-22-298",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-22-298"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiADC version 7.4.1 or above \nPlease upgrade to FortiADC version 7.2.4 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:U/RC:C"
}
]
}
diff --git a/2023/50xxx/CVE-2023-50179.json b/2023/50xxx/CVE-2023-50179.json
index 3fb1e6539ab..50b1724ecff 100644
--- a/2023/50xxx/CVE-2023-50179.json
+++ b/2023/50xxx/CVE-2023-50179.json
@@ -1,17 +1,102 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-50179",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure",
+ "cweId": "CWE-295"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiADC",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "7.4.0"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.6"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.1.0",
+ "version_value": "7.1.4"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.5"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-480",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-480"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiADC version 7.4.1 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.7,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C"
}
]
}
diff --git a/2023/50xxx/CVE-2023-50181.json b/2023/50xxx/CVE-2023-50181.json
index d4eca1b83d0..330f0a8bf05 100644
--- a/2023/50xxx/CVE-2023-50181.json
+++ b/2023/50xxx/CVE-2023-50181.json
@@ -1,17 +1,118 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-50181",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiADC",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "7.4.0",
+ "version_value": "7.4.1"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.4"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.1.0",
+ "version_value": "7.1.4"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.5"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.2.0",
+ "version_value": "6.2.6"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.1.0",
+ "version_value": "6.1.6"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.0.0",
+ "version_value": "6.0.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-469",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-469"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiADC version 7.4.2 or above \nPlease upgrade to FortiADC version 7.2.5 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.8,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:F/RL:X/RC:C"
}
]
}
diff --git a/2024/21xxx/CVE-2024-21759.json b/2024/21xxx/CVE-2024-21759.json
index 03d923259c6..1d1ca2b7014 100644
--- a/2024/21xxx/CVE-2024-21759.json
+++ b/2024/21xxx/CVE-2024-21759.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-21759",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-639"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiPortal",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "7.2.0"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.6"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-011",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-011"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiPortal version 7.4.0 or above \nPlease upgrade to FortiPortal version 7.2.3 or above \nPlease upgrade to FortiPortal version 7.0.8 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 3.9,
+ "baseSeverity": "LOW",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23663.json b/2024/23xxx/CVE-2024-23663.json
index c326135c778..963b1f37919 100644
--- a/2024/23xxx/CVE-2024-23663.json
+++ b/2024/23xxx/CVE-2024-23663.json
@@ -1,17 +1,98 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-23663",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiExtender",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "7.4.0",
+ "version_value": "7.4.2"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.4"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.com/psirt/FG-IR-23-459",
+ "refsource": "MISC",
+ "name": "https://fortiguard.com/psirt/FG-IR-23-459"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiExtender version 7.4.3 or above \nPlease upgrade to FortiExtender version 7.2.5 or above \nPlease upgrade to FortiExtender version 7.0.5 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.1,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X"
}
]
}
diff --git a/2024/26xxx/CVE-2024-26015.json b/2024/26xxx/CVE-2024-26015.json
index 265c89253c6..c66e0b44127 100644
--- a/2024/26xxx/CVE-2024-26015.json
+++ b/2024/26xxx/CVE-2024-26015.json
@@ -1,17 +1,120 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-26015",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-1389"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiProxy",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "7.4.0",
+ "version_value": "7.4.3"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.10"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.18"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "FortiOS",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "7.4.0",
+ "version_value": "7.4.3"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.8"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.15"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-446",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-446"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiProxy version 7.4.4 or above \nPlease upgrade to FortiOS version 7.6.0 or above \nPlease upgrade to FortiOS version 7.4.4 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "HIGH",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 3.1,
+ "baseSeverity": "LOW",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:F/RL:W/RC:R"
}
]
}
diff --git a/2024/27xxx/CVE-2024-27782.json b/2024/27xxx/CVE-2024-27782.json
index d0243b57186..8a59e592258 100644
--- a/2024/27xxx/CVE-2024-27782.json
+++ b/2024/27xxx/CVE-2024-27782.json
@@ -1,17 +1,87 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-27782",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Multiple insufficient session expiration vulnerabilities [CWE-613] in FortiAIOps version 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-613"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiAIOps",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiAIOps version 2.0.1 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.7,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"
}
]
}
diff --git a/2024/27xxx/CVE-2024-27783.json b/2024/27xxx/CVE-2024-27783.json
index 6a87238ebeb..55f19abf3d9 100644
--- a/2024/27xxx/CVE-2024-27783.json
+++ b/2024/27xxx/CVE-2024-27783.json
@@ -1,17 +1,87 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-27783",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Multiple cross-site request forgery (CSRF) vulnerabilities [CWE-352] in FortiAIOps version 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Improper access control",
+ "cweId": "CWE-352"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiAIOps",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-070",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-070"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiAIOps version 2.0.1 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C"
}
]
}
diff --git a/2024/27xxx/CVE-2024-27784.json b/2024/27xxx/CVE-2024-27784.json
index eda9c6f7c28..27ff58a5eaf 100644
--- a/2024/27xxx/CVE-2024-27784.json
+++ b/2024/27xxx/CVE-2024-27784.json
@@ -1,17 +1,87 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-27784",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Multiple Exposure of sensitive information to an unauthorized actor vulnerabilities [CWE-200] in FortiAIOps version 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure",
+ "cweId": "CWE-532"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiAIOps",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiAIOps version 2.0.1 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.3,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"
}
]
}
diff --git a/2024/27xxx/CVE-2024-27785.json b/2024/27xxx/CVE-2024-27785.json
index 9729c7ea8e9..b7fe1ecfd35 100644
--- a/2024/27xxx/CVE-2024-27785.json
+++ b/2024/27xxx/CVE-2024-27785.json
@@ -1,17 +1,87 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-27785",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiAIOps version 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Execute unauthorized code or commands",
+ "cweId": "CWE-1236"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiAIOps",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-073",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-073"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiAIOps version 2.0.1 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.1,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L/E:P/RL:U/RC:C"
}
]
}
diff --git a/2024/33xxx/CVE-2024-33509.json b/2024/33xxx/CVE-2024-33509.json
index 1e5e52ee0c9..2a1d4948eb9 100644
--- a/2024/33xxx/CVE-2024-33509.json
+++ b/2024/33xxx/CVE-2024-33509.json
@@ -1,17 +1,103 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-33509",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@fortinet.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF)."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure",
+ "cweId": "CWE-295"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Fortinet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FortiWeb",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "7.2.0",
+ "version_value": "7.2.1"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "7.0.0",
+ "version_value": "7.0.10"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.4.0",
+ "version_value": "6.4.3"
+ },
+ {
+ "version_affected": "<=",
+ "version_name": "6.3.0",
+ "version_value": "6.3.23"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://fortiguard.fortinet.com/psirt/FG-IR-22-326",
+ "refsource": "MISC",
+ "name": "https://fortiguard.fortinet.com/psirt/FG-IR-22-326"
+ }
+ ]
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "value": "Please upgrade to FortiWeb version 7.2.2 or above \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R"
}
]
}
diff --git a/2024/3xxx/CVE-2024-3708.json b/2024/3xxx/CVE-2024-3708.json
index 137b61a6cee..1d317e4b162 100644
--- a/2024/3xxx/CVE-2024-3708.json
+++ b/2024/3xxx/CVE-2024-3708.json
@@ -5,73 +5,14 @@
"CVE_data_meta": {
"ID": "CVE-2024-3708",
"ASSIGNER": "biossecurity@ami.com",
- "STATE": "PUBLIC"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "A condition exists in lighttpd version prior to 1.4.51 whereby a remote attacker can craft an http request which could result in multiple outcomes:\n1.) cause lighttpd to access freed memory in which case the process lighttpd is running in could be terminated or other non-deterministic behavior could result\n2.) a memory information disclosure event could result which could be used to determine the state of memory which could then be used to theoretically bypass ALSR protections\n\nThis CVE will be updated with more details on July 9th, 2024 after affected parties have had time to remediate."
+ "value": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
- "cweId": "CWE-200"
- }
- ]
- }
- ]
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "vendor_name": "lighttpd",
- "product": {
- "product_data": [
- {
- "product_name": "lighttpd",
- "version": {
- "version_data": [
- {
- "version_affected": "<",
- "version_name": "0",
- "version_value": "1.4.51"
- }
- ]
- }
- }
- ]
- }
- }
- ]
- }
- },
- "references": {
- "reference_data": [
- {
- "url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf",
- "refsource": "MISC",
- "name": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024002.pdf"
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.2.0"
- },
- "source": {
- "discovery": "EXTERNAL"
- },
- "credits": [
- {
- "lang": "en",
- "value": "Peles of VDOO/Jfrog, Alex Matrosov of Binarly"
- }
- ]
+ }
}
\ No newline at end of file
diff --git a/2024/6xxx/CVE-2024-6618.json b/2024/6xxx/CVE-2024-6618.json
new file mode 100644
index 00000000000..d3c13a37ece
--- /dev/null
+++ b/2024/6xxx/CVE-2024-6618.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-6618",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/6xxx/CVE-2024-6619.json b/2024/6xxx/CVE-2024-6619.json
new file mode 100644
index 00000000000..6c88201e7e0
--- /dev/null
+++ b/2024/6xxx/CVE-2024-6619.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-6619",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/6xxx/CVE-2024-6620.json b/2024/6xxx/CVE-2024-6620.json
new file mode 100644
index 00000000000..76c38f3ac78
--- /dev/null
+++ b/2024/6xxx/CVE-2024-6620.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-6620",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/6xxx/CVE-2024-6621.json b/2024/6xxx/CVE-2024-6621.json
new file mode 100644
index 00000000000..84564355bf0
--- /dev/null
+++ b/2024/6xxx/CVE-2024-6621.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-6621",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file