Vulnerabilities > CVE-2024-36509 - Exposure of System Data to an Unauthorized Control Sphere vulnerability in Fortinet Fortiweb

CVSS 4.4 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

fortinet

CWE-497

NVD

Published: 2024-11-12

Updated: 2024-11-14

Summary

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted passwords of other administrators via the "Log Access Event" logs page.

Vulnerable Configurations

Part	Description	Count
Application	Fortinet Fortinet Fortiweb 6.3.0 Fortinet Fortiweb 6.3.1 Fortinet Fortiweb 6.3.2 Fortinet Fortiweb 6.3.3 Fortinet Fortiweb 6.3.4 Fortinet Fortiweb 6.3.5 Fortinet Fortiweb 6.3.6 Fortinet Fortiweb 6.3.7 Fortinet Fortiweb 6.3.8 Fortinet Fortiweb 6.3.9 Fortinet Fortiweb 6.3.10 Fortinet Fortiweb 6.3.11 Fortinet Fortiweb 6.3.12 Fortinet Fortiweb 6.3.13 Fortinet Fortiweb 6.3.14 Fortinet Fortiweb 6.3.15 Fortinet Fortiweb 6.3.16 Fortinet Fortiweb 6.3.17 Fortinet Fortiweb 6.3.18 Fortinet Fortiweb 6.3.19 Fortinet Fortiweb 6.3.20 Fortinet Fortiweb 6.3.21 Fortinet Fortiweb 6.3.22 Fortinet Fortiweb 6.3.23 Fortinet Fortiweb 6.4.0 Fortinet Fortiweb 6.4.1 Fortinet Fortiweb 6.4.2 Fortinet Fortiweb 6.4.3 Fortinet Fortiweb 7.0.0 Fortinet Fortiweb 7.0.1 Fortinet Fortiweb 7.0.2 Fortinet Fortiweb 7.0.3 Fortinet Fortiweb 7.0.4 Fortinet Fortiweb 7.0.7 Fortinet Fortiweb 7.0.10 Fortinet Fortiweb 7.2.0 Fortinet Fortiweb 7.2.1 Fortinet Fortiweb 7.2.2 Fortinet Fortiweb 7.2.5 Fortinet Fortiweb 7.2.8 Fortinet Fortiweb 7.4.0 Fortinet Fortiweb 7.4.2 Fortinet Fortiweb 7.6.0	43

Common Weakness Enumeration (CWE)

CWE-497 - Exposure of System Data to an Unauthorized Control Sphere

Common Attack Pattern Enumeration and Classification (CAPEC)

Footprinting
An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-180