Recently modified vulnerabilities for "fortinet fortiweb" 7.2

Where

AND

Sort:

Fortinet FortiManagerPath traversal in csfd daemon

Risk 47

Severity

9.1

EPSS

0.06%

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder

1 / 2

Source: MITRE

First published (updated )

CVE-2024-48884

Fortinet FortiManagerPath traversal in csfd daemon

Risk 47

Severity

9.1

EPSS

0.04%

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-48885

Microsoft Windows Server 2012 R2PAN-OS: CHAP and PAP When Used with RADIUS Authentication Lead to Privilege Escalation (Severity: MEDIUM)

Risk 96

Severity

5.3

Exploited

Infoleak

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

A fundamental design flaw within the RADIUS protocol has been proven to be exploitable, compromising the integrity in the RADIUS Access-Request process. The attack allows a malicious user to modify packets in a way that would be indistinguishable to a RADIUS client or server. To be successful, the attacker must have the ability to inject themselves between the client and server.

1 / 6

Source: FortiGuard

Remedy

Disable the use of RADIUS/UDP and RADIUS/TCP - instead RADIUS/TLS or RADIUS/DTLS should be used.

Remedy

TBD

Remedy

The best way to address this issue is by using encrypted and authenticated channels that offer modern cryptographic security guarantees. Configure an alternate authentication mechanism if you are using RADIUS with a CHAP or PAP authentication protocol. PAN-OS provides the following alternate RADIUS authentication mechanisms: PEAP-MSCHAPv2 (default), PEAP with GTC, and EAP-TTLS with PAP. For more information, please see https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication/configure-radius-authentication. In addition, instead of using RADIUS, you can configure an alternate authentication mechanism using one of the options described here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication. If you are a Prisma Access customer using a RADIUS configuration with PAP or CHAP in your profile and have not applied one of the changes described above, please reach out to TAC/CS to schedule an upgrade window. PAN-OS 9.1.19, PAN-OS 10.1.14, PAN-OS 10.2.10, PAN-OS 11.0.7, PAN-OS 11.1.3, and all later PAN-OS versions add a new feature to enforce an authentication check in RADIUS. This new feature is disabled by default to match the existing behavior. To enable this feature, run the following commands: > set auth radius-require-msg-authentic yes To confirm that the setting was correctly enabled, run the following command: > show auth radius-require-msg-authentic If set correctly, the response will say "yes". This setting is persistent across reboots. No ‘commit’ is required for this to take effect. Please note that this feature requires that the RADIUS server has been updated to support the new protocol changes, as detailed in https://kb.cert.org/vuls/id/456537. If your RADIUS authentication breaks when radius-require-msg-authentic is set to yes, please work with your RADIUS server vendor for support with the RADIUS server upgrade process.

First published (updated )

CVE-2024-3596

Fortinet FortiWebDirectory Traversal

Risk 66

Severity

7.2

Path Traversal

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.

1 / 2

Source: FortiGuard

Remedy

Please upgrade to FortiWeb version 7.6.3 or above Please upgrade to FortiWeb version 7.4.7 or above

First published (updated )

CVE-2025-25254

Fortinet FortiManager CloudInsertion of Sensitive Information Into Sent Data Vulnerability in csfd daemon

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C

A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiManager Cloud version 7.4.4 or above Upgrade to FortiTester version 7.6.0 or above Upgrade to FortiTester version 7.4.3 or above Upgrade to FortiNDR version 7.6.2 or above Upgrade to FortiNDR version 7.4.9 or above Upgrade to FortiManager version 7.6.2 or above Upgrade to FortiManager version 7.4.4 or above Upgrade to FortiPAM version 1.5.0 or above Upgrade to FortiPAM version 1.4.0 or above Fortinet remediated this issue in FortiSASE version 24.3.b and hence customers do not need to perform any action. Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.5 or above Upgrade to FortiOS version 7.2.9 or above Upgrade to FortiOS version 7.0.16 or above Upgrade to FortiOS version 6.4.16 or above Upgrade to FortiRecorder version 7.2.2 or above Upgrade to FortiRecorder version 7.0.5 or above Upgrade to FortiProxy version 7.4.5 or above Upgrade to FortiProxy version 7.2.11 or above Upgrade to FortiMail version 7.6.0 or above Upgrade to FortiMail version 7.4.3 or above Upgrade to FortiMail version 7.2.7 or above Upgrade to FortiWeb version 7.6.1 or above Upgrade to FortiWeb version 7.4.5 or above Upgrade to FortiVoice version 7.2.0 or above Upgrade to FortiVoice version 7.0.5 or above Upgrade to FortiVoice version 6.4.10 or above

First published (updated )

CVE-2024-47569

Fortinet FortiWebDirectory Traversal

Risk 65

Severity

6.8

Path Traversal

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

First published (updated )

Advisory

FG-IR-24-474

Fortinet FortiManagerPath traversal in csfd daemon

Risk 42

Severity

7.1

Path Traversal

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C

An improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in FortiManager, FortiOS, FortiProxy, FortiRecorder, FortiVoice and FortiWeb may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files and a remote unauthenticated attacker with the same network access to delete an arbitrary folder.

First published (updated )

Advisory

FG-IR-24-259

Trending

Fortinet FortiManagerPath traversal in csfd daemon

Fortinet FortiManagerPath traversal in csfd daemon

Microsoft Windows Server 2012 R2PAN-OS: CHAP and PAP When Used with RADIUS Authentication Lead to Privilege Escalation (Severity: MEDIUM)

Remedy

Remedy

Remedy

Fortinet FortiWebDirectory Traversal

Remedy

Fortinet FortiManager CloudInsertion of Sensitive Information Into Sent Data Vulnerability in csfd daemon

Remedy

Fortinet FortiWebDirectory Traversal

Fortinet FortiManagerPath traversal in csfd daemon

Company

Resources

Contact