CVE-2024-23663
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via
Severity
High 8.1
CVSS 3.1
Exploited
Not listed
EPSS
0.006
47.2th percentile
Discovered by
Not disclosed
Published
Jul 9, 2024
Assigned by fortinet
Description
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.
Weakness: CWE-284
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiExtender | Routing & Switching | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiExtender
- fortinet · fortiextender
Vendor remediation
Please upgrade to FortiExtender version 7.4.3 or above Please upgrade to FortiExtender version 7.2.5 or above Please upgrade to FortiExtender version 7.0.5 or above