CVE-2024-23663
HIGH EPSS 46.1%
Published Jul 9, 20241y ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
Published Jul 9, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
Description
An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
46.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-284
Affected Products 7
| Vendor | Product | Version | Range |
|---|---|---|---|
| fortinet | fortiextender_firmware | * | ≥4.1.1 – ≤4.1.9 |
| fortinet | fortiextender_firmware | * | ≥4.2.0 – ≤4.2.6 |
| fortinet | fortiextender_firmware | * | ≥7.0.0 – ≤7.0.4 |
| fortinet | fortiextender_firmware | * | ≥7.2.0 – ≤7.2.4 |
| fortinet | fortiextender_firmware | * | ≥7.4.0 – ≤7.4.2 |
| fortinet | fortiextender_firmware | 5.3.2 | any |
| fortinet | fortiextender | * | any |
References 1
- fortiguard.com https://fortiguard.com/psirt/FG-IR-23-459
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.