Authentication Flaw in Fortinet FortiOS and FortiProxy Affecting Multiple Versions
CVE-2024-52965
6.8MEDIUM
What is CVE-2024-52965?
An authentication vulnerability exists in Fortinet's FortiOS and FortiProxy products, where an API user can authenticate using an API key combined with a PKI user certificate, even if the provided certificate is invalid. This flaw affects multiple versions of FortiOS and FortiProxy, allowing for potentially unauthorized access to the system. Organizations using these versions should assess their security posture and apply the necessary updates to mitigate potential risks.
Affected Version(s)
FortiOS 7.6.0 <= 7.6.1
FortiOS 7.4.0 <= 7.4.5
FortiOS 7.2.0 <= 7.2.10