CyberCVE

CVE-2024-35277

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through

Severity
High 8.4
CVSS 3.1
Exploited
Not listed
EPSS
0.007
49.5th percentile
Discovered by
Not disclosed
Published
Jan 14, 2025
Assigned by fortinet

Description

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets

Weakness: CWE-306

Affected products

Vendor Product Category Matched by
Fortinet FortiManager Network & Security Management cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiManager

Vendor remediation

Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiManager version 7.0.13 or above Please upgrade to FortiManager version 6.4.15 or above Please upgrade to FortiManager Cloud version 7.4.3 or above Please upgrade to FortiManager Cloud version 7.2.7 or above Please upgrade to FortiManager Cloud version 7.0.13 or above

References