CVE-2024-47575

Published Oct 23, 2024

Last updated 5 months ago

Exploit known CVSS critical 9.8

FortiJump

Network

Zero-day

Overview

Description: A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortimanager, fortimanager_cloud

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet FortiManager Missing Authentication Vulnerability
Exploit added on: Oct 23, 2024
Exploit action due: Nov 13, 2024
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D7E60883-7F64-4C22-99F9-802A7623DAE0",
            "versionEndExcluding": "6.2.13",
            "versionStartIncluding": "6.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D2AD66B0-9C99-4F83-80AA-B54E6354ADFD",
            "versionEndExcluding": "6.4.15",
            "versionStartIncluding": "6.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "37456E27-0EE2-4AF8-B92F-A5284FEC0409",
            "versionEndExcluding": "7.0.13",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "01E63E1E-4084-4C73-862F-A4CC07914C23",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0666260A-1327-4C43-A841-04FB4459449C",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "0141F06A-F5FE-4DF3-B60E-DD76A1AD8A56",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5BB52FA5-7811-4123-8989-59369583F82F",
            "versionEndIncluding": "6.4.7",
            "versionStartIncluding": "6.4.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "29B3A5F2-3121-4902-BBB6-8B4D07767F77",
            "versionEndExcluding": "7.0.13",
            "versionStartIncluding": "7.0.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E3A26BF0-DF69-42F6-B9D8-D3BEE3DD352C",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6E0BCF26-B311-4FFF-866B-3DCA14A26268",
            "versionEndExcluding": "7.4.5",
            "versionStartIncluding": "7.4.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References