{"id":"CVE-2024-36505","state":"PUBLISHED","title":"An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already succes","description":"An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.","publishedAt":"2024-08-13T15:51:56.981Z","updatedAt":"2024-08-15T14:16:57.399Z","severity":{"score":4.7,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:X/RC:R","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiOS"],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.3","versionType":"semver"},{"version":"7.2.5","status":"affected","lessThanOrEqual":"7.2.7","versionType":"semver"},{"version":"7.0.12","status":"affected","lessThanOrEqual":"7.0.14","versionType":"semver"},{"version":"6.4.13","status":"affected","lessThanOrEqual":"6.4.15","versionType":"semver"}]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-24-012"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/36xxx/CVE-2024-36505.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-36505","state":"PUBLISHED","datePublished":"2024-08-13T15:51:56.981Z","dateUpdated":"2024-08-15T14:16:57.399Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-05-29T08:44:50.759Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system."}],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.3","versionType":"semver"},{"version":"7.2.5","status":"affected","lessThanOrEqual":"7.2.7","versionType":"semver"},{"version":"7.0.12","status":"affected","lessThanOrEqual":"7.0.14","versionType":"semver"},{"version":"6.4.13","status":"affected","lessThanOrEqual":"6.4.15","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-012","name":"https://fortiguard.fortinet.com/psirt/FG-IR-24-012"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:X/RC:R"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2024-08-13T15:51:56.981Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiOS version 7.4.4 or above \nPlease upgrade to FortiOS version 7.2.8 or above \nPlease upgrade to FortiOS version 7.0.15 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-15T14:16:37.203552Z","id":"CVE-2024-36505","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-15T14:16:57.399Z"}}]}}}