CyberCVE

CVE-2024-36509

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and b

Severity
Low 3.8
CVSS 3.1
Adjacent, local or physical access what this means
Exploited
Not listed
EPSS
0.002
9.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 12, 2024
Assigned by fortinet

Description

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted passwords of other administrators via the "Log Access Event" logs page.

Weakness: CWE-497

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Check your version Web & Application Security cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Mohamed Amine ZERIAT and Islem MEGHNINE for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiWeb version 7.6.1 or above Please upgrade to FortiWeb version 7.4.4 or above

References

Something wrong here?