Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2024-52965

A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & Fo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.1affected
  • 7.4.0 to ≤ 7.4.5affected
  • 7.2.0 to ≤ 7.2.10affected
  • 7.0.1 to ≤ 7.0.16affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.1affected
  • 7.4.0 to ≤ 7.4.8affected
  • 7.2.0 to ≤ 7.2.13affected
  • 7.0.0 to ≤ 7.0.20affected

References