Back

CVE-2024-36511

Sept. 10, 2024, 3:50 p.m.

Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

Products

FortiADC Web Application Firewall (WAF)

  • 7.4.0 - 7.4.4
  • 7.2
  • 7.1
  • 7.0
  • 6.2
  • 6.1
  • 6.0

Source

psirt@fortinet.com

Tags

psirt@fortinet.com
CWE-358
2024-09-10
CVE-2024-36511

CVE-2024-36511 details

Published : Sept. 10, 2024, 3:15 p.m.
Last Modified : Sept. 10, 2024, 3:50 p.m.

Description

An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature

CVSS Score

1 2 3.7 4 5 6 7 8 9 10

Weakness

Weakness Name Description
CWE-358 Improperly Implemented Security Check for Standard The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

Base Score

3.7

Exploitability Score

2.2

Impact Score

1.4

Base Severity

LOW

Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

URL Source
https://fortiguard.fortinet.com/psirt/FG-IR-22-256 psirt@fortinet.com
This website uses the NVD API, but is not approved or certified by it.