{"id":"CVE-2024-23112","state":"PUBLISHED","title":"An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14,","description":"An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation.","publishedAt":"2024-03-12T15:09:17.877Z","updatedAt":"2024-08-01T22:51:11.269Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiOS","Fortinet FortiProxy"],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.6","versionType":"semver"},{"version":"7.0.1","status":"affected","lessThanOrEqual":"7.0.13","versionType":"semver"},{"version":"6.4.7","status":"affected","lessThanOrEqual":"6.4.14","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.2","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.8","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.14","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-24-013"],"weaknesses":["CWE-639"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/23xxx/CVE-2024-23112.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-23112","state":"PUBLISHED","datePublished":"2024-03-12T15:09:17.877Z","dateUpdated":"2024-08-01T22:51:11.269Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-01-11T16:29:07.979Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation."}],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.6","versionType":"semver"},{"version":"7.0.1","status":"affected","lessThanOrEqual":"7.0.13","versionType":"semver"},{"version":"6.4.7","status":"affected","lessThanOrEqual":"6.4.14","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiProxy","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.2","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.8","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.14","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-013","name":"https://fortiguard.com/psirt/FG-IR-24-013"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-03-12T15:09:17.877Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiOS version 7.4.2 or above \nPlease upgrade to FortiOS version 7.2.7 or above \nPlease upgrade to FortiOS version 7.0.14 or above \nPlease upgrade to FortiOS version 6.4.15 or above \nPlease upgrade to FortiProxy version 7.4.3 or above \nPlease upgrade to FortiProxy version 7.2.9 or above \nPlease upgrade to FortiProxy version 7.0.15 or above \n"}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortinet","product":"fortios","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.1","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortios","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.6","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortios","defaultStatus":"unaffected","versions":[{"version":"7.0.1","status":"affected","lessThanOrEqual":"7.0.13","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortios","defaultStatus":"unaffected","versions":[{"version":"6.4.7","status":"affected","lessThanOrEqual":"6.4.14","versionType":"semver"}],"cpes":["cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortiproxy","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.2","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortiproxy","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.8","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*"]},{"vendor":"fortinet","product":"fortiproxy","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.14","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-03-16T04:00:42.744773Z","id":"CVE-2024-23112","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-25T15:56:14.854Z"}},{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-013","name":"https://fortiguard.com/psirt/FG-IR-24-013","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:51:11.269Z"}}]}}}