Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

FortiWeb

7.2.0 - 7.2.1

Source

psirt@fortinet.com

CVE-2024-33509 details

Published : July 9, 2024, 4:15 p.m.
Last Modified : July 9, 2024, 6:18 p.m.

Description

An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

CVSS Score

1	2	3	4.8	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-295	Improper Certificate Validation	The product does not validate, or incorrectly validates, a certificate.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Base Score

4.8

Exploitability Score

2.2

Impact Score

2.5

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

URL	Source
https://fortiguard.fortinet.com/psirt/FG-IR-22-326	psirt@fortinet.com

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-33509