CVE-2024-33506
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned
Exploited
Not listed
EPSS
0.004
36.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Oct 8, 2024
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain (ADOM) to access device summary of unauthorized ADOMs via crafted HTTP requests.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiManager Check your version | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiManager
Credit
Internally discovered and reported by Leslie Zhou of Fortinet Vulnerability Research team.
Vendor remediation
Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above