CVE-2024-47575

Fortinet · Published October 23, 2024

9.8

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Affected Products

Fortimanager < 6.2.13
Fortimanager < 6.4.15
Fortimanager < 7.0.13
Fortimanager < 7.2.8

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H