CVE-2024-33510
Nov. 13, 2024, 5:01 p.m.
Tags
CVSS Score
Product(s) Impacted
FortiOS
- 7.4.3 and below
- 7.2.8 and below
- 7.0.16 and below
FortiProxy
- 7.4.3 and below
- 7.2.9 and below
- 7.0.16 and below
FortiSASE
- 24.2.b
Description
An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.
Weaknesses
CWE-358
Improperly Implemented Security Check for Standard
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
CWE ID: 358Date
Published: Nov. 12, 2024, 7:15 p.m.
Last Modified: Nov. 13, 2024, 5:01 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
psirt@fortinet.com
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Base Score
Exploitability Score
Impact Score
Base Severity
MEDIUMCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N