CVE-2024-23663 — Improper Access Control in Fortinet Fortiextender

CWE-284 — Improper Access Control4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.7%
top 28.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiextenderFortinet Fortiextender Firmware
Timeline
PublishedJul 9

Description

An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5fortinet/fortiextender7.4.0 — 7.4.2+2
▶NVDfortinet/fortiextender_firmware4.1.1 — 4.1.9+5

🔴Vulnerability Details

2
GHSA
GHSA-r293-2ppv-632r: An improper access control in Fortinet FortiExtender 4↗2024-07-09
▶
CVEList
CVE-2024-23663: An improper access control in Fortinet FortiExtender 4↗2024-07-09
▶

📋Vendor Advisories

1
Fortinet
Privilege escalation from low privilege administrator↗2024-07-09
▶
CVE-2024-23663 — Improper Access Control in Fortinet | cvebase