CVE-2024-52966: Disclosure of Logs of Devices not belonging to the Current ADOM from Log View
First published: Tue Feb 11 2025(Updated: )
An Exposure of Sensitive Information to an Unauthorized Actor [CWE-200] in the Log View component of FortiAnalyzer may allow a local authenticated user with admin privileges to view logs of devices not belonging to the current ADOM
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | >=6.4.0<7.6.0 | |
| Fortinet FortiAnalyzer | =. | |
| Fortinet FortiAnalyzer | >=7.4.0<=7.4.4 | |
| Fortinet FortiAnalyzer | >=7.2.0<=7.2.7 | |
| Fortinet FortiAnalyzer | >=7.0 | |
| Fortinet FortiAnalyzer | >=6.4 |
Remedy
Please upgrade to FortiAnalyzer version 7.6.1 or above Please upgrade to FortiAnalyzer version 7.4.5 or above Please upgrade to FortiAnalyzer version 7.2.8 or above Please upgrade to FortiManager version 7.6.1 or above Please upgrade to FortiManager version 7.4.5 or above Please upgrade to FortiManager version 7.2.8 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52966?
CVE-2024-52966 is classified as a medium severity vulnerability that allows exposure of sensitive information to unauthorized actors.
How do I fix CVE-2024-52966?
To resolve CVE-2024-52966, upgrade FortiAnalyzer to version 7.6.1 or later after ensuring you are running a vulnerable version.
Who is affected by CVE-2024-52966?
CVE-2024-52966 affects FortiAnalyzer versions from 6.4.0 to 7.6.0, specifically when local authenticated users have admin privileges.
What type of vulnerability is CVE-2024-52966?
CVE-2024-52966 is an Exposure of Sensitive Information vulnerability as defined by CWE-200.
What impact does CVE-2024-52966 have on security?
CVE-2024-52966 can allow a local authenticated user to view logs of devices not belonging to their current administrative domain, potentially leading to data leakage.
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-52966
- agent/first-publish-date
- collector/fortiguard-psirt
- agent/title
- agent/references
- agent/softwarecombine
- agent/description
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/fortinet
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/.
- version/fortinet fortianalyzer/7.4.0
- version/fortinet fortianalyzer/7.4.4
- version/fortinet fortianalyzer/7.2.0
- version/fortinet fortianalyzer/7.2.7
- version/fortinet fortianalyzer/7.0
- version/fortinet fortianalyzer/6.4