{"id":"CVE-2024-55592","state":"PUBLISHED","title":"An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all ","description":"An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.","publishedAt":"2025-03-11T14:54:29.067Z","updatedAt":"2025-03-11T16:07:03.773Z","severity":{"score":3.6,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiSIEM"],"affected":[{"vendor":"Fortinet","product":"FortiSIEM","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.1.0","status":"affected","lessThanOrEqual":"7.1.7","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.7.0","status":"affected","lessThanOrEqual":"6.7.9","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThanOrEqual":"6.6.5","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThanOrEqual":"6.5.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.1","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"5.4.0","status":"affected"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.3","versionType":"semver"}],"cpes":[]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-24-377"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/55xxx/CVE-2024-55592.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-55592","state":"PUBLISHED","datePublished":"2025-03-11T14:54:29.067Z","dateUpdated":"2025-03-11T16:07:03.773Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2024-12-09T11:19:49.470Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests."}],"affected":[{"vendor":"Fortinet","product":"FortiSIEM","defaultStatus":"unaffected","versions":[{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.1.0","status":"affected","lessThanOrEqual":"7.1.7","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.7.0","status":"affected","lessThanOrEqual":"6.7.9","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThanOrEqual":"6.6.5","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThanOrEqual":"6.5.3","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThanOrEqual":"6.4.4","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.1","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.2","versionType":"semver"},{"version":"5.4.0","status":"affected"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.3","versionType":"semver"}],"cpes":[]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-377","name":"https://fortiguard.fortinet.com/psirt/FG-IR-24-377"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.6,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","lang":"en","description":"Improper access control","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2025-03-11T14:54:29.067Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiSIEM version 7.3.0 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-11T16:06:54.927466Z","id":"CVE-2024-55592","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-11T16:07:03.773Z"}}]}}}