CVE-2024-50565
Description
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2, 6.4.0 through 6.4.8 and 6.0.0 through 6.0.12 and Fortinet FortiWeb version 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 allows an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device
How to fix
- fortinet fortiweb7.4.3 or later
- fortinet fortivoice6.4.9, 7.0.3 or later
- fortinet fortiproxy7.0.16, 7.2.10, 7.4.3 or later
- fortinet fortios7.0.16, 7.2.9, 7.4.5 or later
- fortinet fortimanager6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 or later
- fortinet fortianalyzer6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiweb | 7.4.0 ≤ v < 7.4.3 | 7.4.3 |
| fortinet fortivoice | 6.0.0 ≤ v < 6.4.9, 7.0.0 ≤ v < 7.0.3 | 6.4.9, 7.0.3 |
| fortinet fortiproxy | 2.0.0 ≤ v < 7.0.16, 7.2.0 ≤ v < 7.2.10, 7.4.0 ≤ v < 7.4.3 | 7.0.16, 7.2.10, 7.4.3 |
| fortinet fortios | 6.4.0 ≤ v < 7.0.16, 7.2.0 ≤ v < 7.2.9, 7.4.0 ≤ v < 7.4.5 | 7.0.16, 7.2.9, 7.4.5 |
| fortinet fortimanager | 6.2.0 ≤ v < 6.2.14, 6.4.0 ≤ v < 6.4.15, 7.0.0 ≤ v < 7.0.12, 7.2.0 ≤ v < 7.2.5, 7.4.0 ≤ v < 7.4.3 | 6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 |
| fortinet fortianalyzer | 6.2.0 ≤ v < 6.2.14, 6.4.0 ≤ v < 6.4.15, 7.0.0 ≤ v < 7.0.12, 7.2.0 ≤ v < 7.2.5, 7.4.0 ≤ v < 7.4.3 | 6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.