CVE-2024-33509

4.8MEDIUM

Key Information

Vendor
Fortinet
Status
Fortiweb
Vendor
CVE Published:
9 July 2024

Summary

An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

Affected Version(s)

FortiWeb <= 7.2.1

FortiWeb <= 7.0.10

FortiWeb <= 6.4.3

Refferences

https://fortiguard.fortinet.com/psirt/FG-IR-22-326

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database
.