2024-11-12 21:03:22 +00:00
{
"id" : "CVE-2024-26011" ,
"sourceIdentifier" : "psirt@fortinet.com" ,
"published" : "2024-11-12T19:15:08.320" ,
2024-12-12 21:03:45 +00:00
"lastModified" : "2024-12-12T19:33:58.833" ,
"vulnStatus" : "Analyzed" ,
2024-11-12 21:03:22 +00:00
"cveTags" : [ ] ,
"descriptions" : [
{
"lang" : "en" ,
"value" : "A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets."
2024-11-13 19:03:36 +00:00
} ,
{
"lang" : "es" ,
"value" : "Autenticaci\u00f3n faltante para funci\u00f3n cr\u00edtica en Fortinet FortiManager versi\u00f3n 7.4.0 a 7.4.2, 7.2.0 a 7.2.4, 7.0.0 a 7.0.11, 6.4.0 a 6.4.14, FortiPAM versi\u00f3n 1.2.0, 1.1.0 a 1.1.2, 1.0.0 a 1.0.3, FortiProxy versi\u00f3n 7.4.0 a 7.4.2, 7.2.0 a 7.2.9, 7.0.0 a 7.0.17, 2.0.0 a 2.0.14, 1.2.0 a 1.2.13, 1.1.0 a 1.1.6, 1.0.0 a 1.0.7, FortiSwitchManager versi\u00f3n 7.2.0 a 7.2.3, 7.0.0 a 7.0.3, FortiPortal versi\u00f3n 6.0.0 a 6.0.14, FortiOS versi\u00f3n 7.4.0 a 7.4.3, 7.2.0 a 7.2.7, 7.0.0 a 7.0.14, 6.4.0 a 6.4.15, 6.2.0 a 6.2.16, 6.0.0 a 6.0.18 permite a un atacante ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de paquetes especialmente manipulados."
2024-11-12 21:03:22 +00:00
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "psirt@fortinet.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 5.3 ,
"baseSeverity" : "MEDIUM" ,
2024-11-12 21:03:22 +00:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "NONE" ,
"integrityImpact" : "LOW" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2024-11-12 21:03:22 +00:00
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 1.4
2024-12-12 21:03:45 +00:00
} ,
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
2024-11-12 21:03:22 +00:00
}
]
} ,
"weaknesses" : [
{
"source" : "psirt@fortinet.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-306"
}
]
2024-12-12 21:03:45 +00:00
} ,
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-306"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "6.0.0" ,
"versionEndExcluding" : "7.0.15" ,
"matchCriteriaId" : "4A93633F-8865-49D7-A5CE-F7D009DFB901"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.2.0" ,
"versionEndExcluding" : "7.2.8" ,
"matchCriteriaId" : "A6D2A14F-3916-45A0-AD4D-27C60E00AEC0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.4.0" ,
"versionEndExcluding" : "7.4.4" ,
"matchCriteriaId" : "1FDDB5F3-D229-4208-9110-8860A03C8B59"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "1.0.0" ,
"versionEndExcluding" : "1.3.0" ,
"matchCriteriaId" : "18427F16-7339-4A9E-9FA4-EC7A2D3EE218"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "1.0.0" ,
"versionEndExcluding" : "7.0.17" ,
"matchCriteriaId" : "E7E7DA8E-34CB-4527-A4A0-1EDBFBBDA894"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.2.0" ,
"versionEndExcluding" : "7.2.10" ,
"matchCriteriaId" : "EDFFA2C3-0A23-4884-B751-785BE598DFF3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.4.0" ,
"versionEndExcluding" : "7.4.4" ,
"matchCriteriaId" : "3F2C29AD-A11F-4A5F-8BB0-8600D5F77E72"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "6.4.0" ,
"versionEndExcluding" : "6.4.15" ,
"matchCriteriaId" : "D2AD66B0-9C99-4F83-80AA-B54E6354ADFD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.0.0" ,
"versionEndExcluding" : "7.0.12" ,
"matchCriteriaId" : "56DC03E9-D1CF-4273-AF2F-5EB3B8E2D54B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.2.0" ,
"versionEndExcluding" : "7.2.5" ,
"matchCriteriaId" : "4763E504-6974-42C5-B912-3E62A9CC312A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.4.0" ,
"versionEndExcluding" : "7.4.3" ,
"matchCriteriaId" : "E4490512-36ED-4212-9D34-D74739A56E84"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.0.0" ,
"versionEndExcluding" : "7.0.4" ,
"matchCriteriaId" : "7A020C2E-1DDB-4737-92D9-B125FFBE007A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "7.2.0" ,
"versionEndExcluding" : "7.2.4" ,
"matchCriteriaId" : "EB0D2553-E4E6-454A-80F6-9D014A4710D3"
}
]
}
]
} ,
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:fortinet:fortiportal:*:*:*:*:*:*:*:*" ,
"versionStartIncluding" : "5.3.0" ,
"versionEndExcluding" : "6.0.15" ,
"matchCriteriaId" : "0123003E-587B-4EC8-83B6-0C5D87A8AC10"
}
]
}
]
2024-11-12 21:03:22 +00:00
}
] ,
"references" : [
{
"url" : "https://fortiguard.fortinet.com/psirt/FG-IR-24-032" ,
2024-12-12 21:03:45 +00:00
"source" : "psirt@fortinet.com" ,
"tags" : [
"Vendor Advisory"
]
2024-11-12 21:03:22 +00:00
}
]
}
