CyberCVE

CVE-2024-54020

A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update

Severity
Low 2.1
CVSS 3.1
Adjacent, local or physical access what this means
Exploited
Not listed
EPSS
0.002
9.4th percentile
Discovered by
Vendor
Vendor advisory field
Published
May 28, 2025
Assigned by fortinet

Description

A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests.

Weakness: CWE-862

Affected products

Vendor Product Category Matched by
Fortinet FortiManager Check your version Network & Security Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiManager

Credit

Internal

Vendor remediation

Please upgrade to FortiManager version 7.4.0 or above Please upgrade to FortiManager version 7.2.2 or above Please upgrade to FortiManager version 7.0.8 or above

References

Something wrong here?