CVE-2024-33506: Priviledged admin able to view device summary for device in different ADOM
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.12 and below allows a remote authenticated attacker assigned to an Administrative Domain (ADOM) to access device summary of unauthorized ADOMs via crafted HTTP requests.
Other sources
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager Administrative Domain (ADOM) may allow a remote authenticated attacker assigned to an ADOM to access device summary of other ADOMs via crafted HTTP requests.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33506?
CVE-2024-33506 is classified as a medium severity vulnerability due to the risk of unauthorized access to sensitive information.
How do I fix CVE-2024-33506?
To remediate CVE-2024-33506, upgrade FortiManager to version 7.4.3, 7.2.6, or later.
Who is affected by CVE-2024-33506?
CVE-2024-33506 affects users of FortiManager versions 7.4.2 and below, 7.2.5 and below, and 7.0.12 and below.
What type of vulnerability is CVE-2024-33506?
CVE-2024-33506 is an exposure of sensitive information to an unauthorized actor vulnerability (CWE-200).
Can CVE-2024-33506 be exploited remotely?
Yes, CVE-2024-33506 can be exploited remotely by an authenticated attacker within an Administrative Domain (ADOM).