cvelistv5 - cve-2023-50176

CVE-2023-50176 (GCVE-0-2023-50176)

Vulnerability from cvelistv5

Published

2024-11-12 18:53

Modified

2024-11-13 18:31

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P

CWE

CWE-384 - Execute unauthorized code or commands

Summary

A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.

References

URL

	Vendor	Product	Version
	Fortinet	FortiOS	Version: 7.4.0 ≤ 7.4.3 Version: 7.2.0 ≤ 7.2.7 Version: 7.0.0 ≤ 7.0.13 cpe:2.3:o:fortinet:fortios:7.4.3:::::::* cpe:2.3:o:fortinet:fortios:7.4.2:::::::* cpe:2.3:o:fortinet:fortios:7.4.1:::::::* cpe:2.3:o:fortinet:fortios:7.4.0:::::::* cpe:2.3:o:fortinet:fortios:7.2.7:::::::* cpe:2.3:o:fortinet:fortios:7.2.6:::::::* cpe:2.3:o:fortinet:fortios:7.2.5:::::::* cpe:2.3:o:fortinet:fortios:7.2.4:::::::* cpe:2.3:o:fortinet:fortios:7.2.3:::::::* cpe:2.3:o:fortinet:fortios:7.2.2:::::::* cpe:2.3:o:fortinet:fortios:7.2.1:::::::* cpe:2.3:o:fortinet:fortios:7.2.0:::::::* cpe:2.3:o:fortinet:fortios:7.0.13:::::::* cpe:2.3:o:fortinet:fortios:7.0.12:::::::* cpe:2.3:o:fortinet:fortios:7.0.11:::::::* cpe:2.3:o:fortinet:fortios:7.0.10:::::::* cpe:2.3:o:fortinet:fortios:7.0.9:::::::* cpe:2.3:o:fortinet:fortios:7.0.8:::::::* cpe:2.3:o:fortinet:fortios:7.0.7:::::::* cpe:2.3:o:fortinet:fortios:7.0.6:::::::* cpe:2.3:o:fortinet:fortios:7.0.5:::::::* cpe:2.3:o:fortinet:fortios:7.0.4:::::::* cpe:2.3:o:fortinet:fortios:7.0.3:::::::* cpe:2.3:o:fortinet:fortios:7.0.2:::::::* cpe:2.3:o:fortinet:fortios:7.0.1:::::::* cpe:2.3:o:fortinet:fortios:7.0.0:::::::*

ghsa-cfhv-h3jw-vx5r

Vulnerability from github

Published

2024-11-12 21:30

Modified

2024-11-12 21:30

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-50176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T19:15:07Z",
    "severity": "HIGH"
  },
  "details": "A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.",
  "id": "GHSA-cfhv-h3jw-vx5r",
  "modified": "2024-11-12T21:30:51Z",
  "published": "2024-11-12T21:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50176"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-475"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

icsa-24-193-02

Vulnerability from csaf_cisa

Published

2024-07-09 00:00

Modified

2025-11-11 00:00

Summary

Siemens RUGGEDCOM APE 1808

Notes

Summary

Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-698820 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Critical infrastructure sectors

Communications, Critical Manufacturing, Energy, and Transportation

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet\u0027s upstream security notifications.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "other",
        "text": "This ICSA is a verbatim republication of Siemens ProductCERT SSA-698820 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory.  Further, CISA does not endorse any commercial product or service.  Please contact Siemens ProductCERT directly for any questions regarding this advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Communications, Critical Manufacturing, Energy, and Transportation",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-698820.json"
      },
      {
        "category": "self",
        "summary": "SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-698820.html"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-193-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-193-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      }
    ],
    "title": "Siemens RUGGEDCOM APE 1808",
    "tracking": {
      "current_release_date": "2025-11-11T00:00:00.000000Z",
      "generator": {
        "date": "2025-11-17T18:18:47.366027Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-24-193-02",
      "initial_release_date": "2024-07-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-07-09T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-08-13T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated CVE-2024-23111 description and added newly published CVE-2024-26006 and CVE-2024-26015"
        },
        {
          "date": "2024-09-10T00:00:00.000000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added newly published upstream vulnerability CVE-2024-36505"
        },
        {
          "date": "2024-10-08T00:00:00.000000Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Added fix for Fortinet NGFW as released from Siemens for RUGGEDCOM APE1808; added mitigations for CVE-2024-26006 and CVE-2024-26010"
        },
        {
          "date": "2024-12-10T00:00:00.000000Z",
          "legacy_version": "1.4",
          "number": "5",
          "summary": "Added newly published upstream vulnerabilities CVE-2024-33510, CVE-2023-50176, CVE-2024-26011"
        },
        {
          "date": "2025-02-11T00:00:00.000000Z",
          "legacy_version": "1.5",
          "number": "6",
          "summary": "Added newly published upstream vulnerabilities CVE-2024-48886 and CVE-2024-50563"
        },
        {
          "date": "2025-04-08T00:00:00.000000Z",
          "legacy_version": "1.6",
          "number": "7",
          "summary": "Removed CVE-2024-48886 and CVE-2024-50563 due to wrong fix information. These CVEs are advised in SSA-770770"
        },
        {
          "date": "2025-06-10T00:00:00.000000Z",
          "legacy_version": "1.7",
          "number": "8",
          "summary": "Added newly published upstream vulnerability CVE-2025-47295"
        },
        {
          "date": "2025-07-08T00:00:00.000000Z",
          "legacy_version": "1.8",
          "number": "9",
          "summary": "Added newly published upstream vulnerability CVE-2024-50568"
        },
        {
          "date": "2025-11-11T00:00:00.000000Z",
          "legacy_version": "1.9",
          "number": "10",
          "summary": "Added newly published upstream vulnerability CVE-2024-26008"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "RUGGEDCOM APE1808",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM APE1808"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-46720",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-46720"
    },
    {
      "cve": "CVE-2023-50176",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2023-50176"
    },
    {
      "cve": "CVE-2024-21754",
      "cwe": {
        "id": "CWE-916",
        "name": "Use of Password Hash With Insufficient Computational Effort"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a\u00a0privileged attacker with super-admin profile and CLI access to decrypting the backup file.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-21754"
    },
    {
      "cve": "CVE-2024-23111",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of input during web page Generation (\u0027Cross-site Scripting\u0027) vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-23111"
    },
    {
      "cve": "CVE-2024-26006",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS and FortiProxy\u0027s web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via social engineering the targeted user into bookmarking a malicious samba server, then opening the bookmark.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Disable SSL-VPN web-mode (see https://fortiguard.fortinet.com/psirt/FG-IR-23-485)",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-26006"
    },
    {
      "cve": "CVE-2024-26008",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-26008"
    },
    {
      "cve": "CVE-2024-26010",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specially crafted packets.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For each interface, remove the fgfm access (see https://www.fortiguard.com/psirt/FG-IR-24-036)",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-26010"
    },
    {
      "cve": "CVE-2024-26011",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-26011"
    },
    {
      "cve": "CVE-2024-26015",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-26015"
    },
    {
      "cve": "CVE-2024-33510",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An\u00a0improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027) vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-33510"
    },
    {
      "cve": "CVE-2024-36505",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-36505"
    },
    {
      "cve": "CVE-2024-50568",
      "cwe": {
        "id": "CWE-300",
        "name": "Channel Accessible by Non-Endpoint"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-50568"
    },
    {
      "cve": "CVE-2025-47295",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A buffer over-read vulnerability in FortiOS may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker\u0027s control.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2025-47295"
    }
  ]
}

ssa-698820

Vulnerability from csaf_siemens

Published

2024-07-09 00:00

Modified

2025-11-11 00:00

Summary

SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices

Notes

Summary

General Recommendations

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet\u0027s upstream security notifications.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-698820.html"
      },
      {
        "category": "self",
        "summary": "SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-698820.json"
      }
    ],
    "title": "SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices",
    "tracking": {
      "current_release_date": "2025-11-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-698820",
      "initial_release_date": "2024-07-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-07-09T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-08-13T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated CVE-2024-23111 description and added newly published CVE-2024-26006 and CVE-2024-26015"
        },
        {
          "date": "2024-09-10T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added newly published upstream vulnerability CVE-2024-36505"
        },
        {
          "date": "2024-10-08T00:00:00Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Added fix for Fortinet NGFW as released from Siemens for RUGGEDCOM APE1808; added mitigations for CVE-2024-26006 and CVE-2024-26010"
        },
        {
          "date": "2024-12-10T00:00:00Z",
          "legacy_version": "1.4",
          "number": "5",
          "summary": "Added newly published upstream vulnerabilities CVE-2024-33510, CVE-2023-50176, CVE-2024-26011"
        },
        {
          "date": "2025-02-11T00:00:00Z",
          "legacy_version": "1.5",
          "number": "6",
          "summary": "Added newly published upstream vulnerabilities CVE-2024-48886 and CVE-2024-50563"
        },
        {
          "date": "2025-04-08T00:00:00Z",
          "legacy_version": "1.6",
          "number": "7",
          "summary": "Removed CVE-2024-48886 and CVE-2024-50563 due to wrong fix information. These CVEs are advised in SSA-770770"
        },
        {
          "date": "2025-06-10T00:00:00Z",
          "legacy_version": "1.7",
          "number": "8",
          "summary": "Added newly published upstream vulnerability CVE-2025-47295"
        },
        {
          "date": "2025-07-08T00:00:00Z",
          "legacy_version": "1.8",
          "number": "9",
          "summary": "Added newly published upstream vulnerability CVE-2024-50568"
        },
        {
          "date": "2025-11-11T00:00:00Z",
          "legacy_version": "1.9",
          "number": "10",
          "summary": "Added newly published upstream vulnerability CVE-2024-26008"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "RUGGEDCOM APE1808",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "RUGGEDCOM APE1808"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-46720",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-46720"
    },
    {
      "cve": "CVE-2023-50176",
      "cwe": {
        "id": "CWE-384",
        "name": "Session Fixation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2023-50176"
    },
    {
      "cve": "CVE-2024-21754",
      "cwe": {
        "id": "CWE-916",
        "name": "Use of Password Hash With Insufficient Computational Effort"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a\u00a0privileged attacker with super-admin profile and CLI access to decrypting the backup file.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-21754"
    },
    {
      "cve": "CVE-2024-23111",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of input during web page Generation (\u0027Cross-site Scripting\u0027) vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-23111"
    },
    {
      "cve": "CVE-2024-26006",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS and FortiProxy\u0027s web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via social engineering the targeted user into bookmarking a malicious samba server, then opening the bookmark.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Disable SSL-VPN web-mode (see https://fortiguard.fortinet.com/psirt/FG-IR-23-485)",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-26006"
    },
    {
      "cve": "CVE-2024-26008",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-26008"
    },
    {
      "cve": "CVE-2024-26010",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack-based buffer overflow in Fortinet FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiWeb, FortiAuthenticator, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.1 through 7.0.3, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specially crafted packets.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "For each interface, remove the fgfm access (see https://www.fortiguard.com/psirt/FG-IR-24-036)",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-26010"
    },
    {
      "cve": "CVE-2024-26011",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-26011"
    },
    {
      "cve": "CVE-2024-26015",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-26015"
    },
    {
      "cve": "CVE-2024-33510",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An\u00a0improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027) vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-33510"
    },
    {
      "cve": "CVE-2024-36505",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-36505"
    },
    {
      "cve": "CVE-2024-50568",
      "cwe": {
        "id": "CWE-300",
        "name": "Channel Accessible by Non-Endpoint"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-50568"
    },
    {
      "cve": "CVE-2025-47295",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A buffer over-read vulnerability in FortiOS may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker\u0027s control.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update Fortigate NGFW to V7.4.4. Contact customer support to receive patch and update information.",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-47295"
    }
  ]
}

gsd-2023-50176

Vulnerability from gsd

Modified

2023-12-13 01:20

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-50176

Aliases

CVE-2023-50176

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-50176",
    "id": "GSD-2023-50176"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-50176"
      ],
      "id": "GSD-2023-50176",
      "modified": "2023-12-13T01:20:31.346101Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-50176",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

fkie_cve-2023-50176

Vulnerability from fkie_nvd

Published

2024-11-12 19:15

Modified

2024-12-12 19:27

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-23-475	Vendor Advisory

Impacted products

Vendor	Product	Version
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C119229A-3805-47C1-B3F9-AF1A4007A63B",
              "versionEndExcluding": "7.0.14",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6D2A14F-3916-45A0-AD4D-27C60E00AEC0",
              "versionEndExcluding": "7.2.8",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FDDB5F3-D229-4208-9110-8860A03C8B59",
              "versionEndExcluding": "7.4.4",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link."
    },
    {
      "lang": "es",
      "value": "Una fijaci\u00f3n de sesi\u00f3n en Fortinet FortiOS versi\u00f3n 7.4.0 a 7.4.3 y 7.2.0 a 7.2.7 y 7.0.0 a 7.0.13 permite a un atacante ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de un enlace de autenticaci\u00f3n SAML de phishing."
    }
  ],
  "id": "CVE-2023-50176",
  "lastModified": "2024-12-12T19:27:35.530",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-11-12T19:15:07.360",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-475"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Primary"
    }
  ]
}

cnvd-2024-49648

Vulnerability from cnvd

Title

Fortinet FortiOS访问控制错误漏洞（CNVD-2024-49648）

Description

Fortinet FortiOS是美国飞塔（Fortinet）公司的一套专用于FortiGate网络安全平台上的安全操作系统。该系统为用户提供防火墙、防病毒、IPSec/SSLVPN、Web内容过滤和反垃圾邮件等多种安全功能。 Fortinet FortiOS存在访问控制错误漏洞，该漏洞源于包含一个会话固定问题。攻击者可利用该漏洞通过网络钓鱼SAML身份验证链接执行未经授权的代码或命令。

Severity

高

Patch Name

Fortinet FortiOS访问控制错误漏洞（CNVD-2024-49648）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://fortiguard.fortinet.com/psirt/FG-IR-23-475

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-50176

Impacted products

Name
['Fortinet FortiOS >=7.0.0，<7.0.14', 'Fortinet FortiOS >=7.4.0，<7.4.4', 'Fortinet FortiOS >=7.2.0，<7.2.8']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-50176",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-50176"
    }
  },
  "description": "Fortinet FortiOS\u662f\u7f8e\u56fd\u98de\u5854\uff08Fortinet\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8eFortiGate\u7f51\u7edc\u5b89\u5168\u5e73\u53f0\u4e0a\u7684\u5b89\u5168\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u4e3a\u7528\u6237\u63d0\u4f9b\u9632\u706b\u5899\u3001\u9632\u75c5\u6bd2\u3001IPSec/SSLVPN\u3001Web\u5185\u5bb9\u8fc7\u6ee4\u548c\u53cd\u5783\u573e\u90ae\u4ef6\u7b49\u591a\u79cd\u5b89\u5168\u529f\u80fd\u3002\n\nFortinet FortiOS\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5305\u542b\u4e00\u4e2a\u4f1a\u8bdd\u56fa\u5b9a\u95ee\u9898\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7f51\u7edc\u9493\u9c7cSAML\u8eab\u4efd\u9a8c\u8bc1\u94fe\u63a5\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u4ee3\u7801\u6216\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://fortiguard.fortinet.com/psirt/FG-IR-23-475",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-49648",
  "openTime": "2024-12-31",
  "patchDescription": "Fortinet FortiOS\u662f\u7f8e\u56fd\u98de\u5854\uff08Fortinet\uff09\u516c\u53f8\u7684\u4e00\u5957\u4e13\u7528\u4e8eFortiGate\u7f51\u7edc\u5b89\u5168\u5e73\u53f0\u4e0a\u7684\u5b89\u5168\u64cd\u4f5c\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u4e3a\u7528\u6237\u63d0\u4f9b\u9632\u706b\u5899\u3001\u9632\u75c5\u6bd2\u3001IPSec/SSLVPN\u3001Web\u5185\u5bb9\u8fc7\u6ee4\u548c\u53cd\u5783\u573e\u90ae\u4ef6\u7b49\u591a\u79cd\u5b89\u5168\u529f\u80fd\u3002\r\n\r\nFortinet FortiOS\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5305\u542b\u4e00\u4e2a\u4f1a\u8bdd\u56fa\u5b9a\u95ee\u9898\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7f51\u7edc\u9493\u9c7cSAML\u8eab\u4efd\u9a8c\u8bc1\u94fe\u63a5\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u4ee3\u7801\u6216\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Fortinet FortiOS\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2024-49648\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Fortinet FortiOS \u003e=7.0.0\uff0c\u003c7.0.14",
      "Fortinet FortiOS \u003e=7.4.0\uff0c\u003c7.4.4",
      "Fortinet FortiOS \u003e=7.2.0\uff0c\u003c7.2.8"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-50176",
  "serverity": "\u9ad8",
  "submitTime": "2024-11-15",
  "title": "Fortinet FortiOS\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2024-49648\uff09"
}

WID-SEC-W-2024-3438

Vulnerability from csaf_certbund

Published

2024-11-12 23:00

Modified

2024-11-12 23:00

Summary

Fortinet FortiOS undFortiProxy: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

FortiOS ist ein gehärtetes Betriebssystem für FortiGate Plattformen. FortiProxy ist eine Web-Proxy Lösung.

Angriff

Ein anonymer Angreifer kann mehrere Schwachstellen in Fortinet FortiOS und Fortinet FortiProxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Phishing-Angriffe durchzuführen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FortiOS ist ein geh\u00e4rtetes Betriebssystem f\u00fcr FortiGate Plattformen.\r\nFortiProxy ist eine Web-Proxy L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein anonymer Angreifer kann mehrere Schwachstellen in Fortinet FortiOS und Fortinet FortiProxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Phishing-Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3438 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3438.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3438 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3438"
      },
      {
        "category": "external",
        "summary": "FortiGuard PSIRT Advisory FG-IR-23-475 vom 2024-11-12",
        "url": "https://www.fortiguard.com/psirt/FG-IR-23-475"
      },
      {
        "category": "external",
        "summary": "FortiGuard PSIRT Advisory FG-IR-24-033 vom 2024-11-12",
        "url": "https://www.fortiguard.com/psirt/FG-IR-24-033"
      }
    ],
    "source_lang": "en-US",
    "title": "Fortinet FortiOS undFortiProxy: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-12T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-13T11:47:45.933+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3438",
      "initial_release_date": "2024-11-12T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-12T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.4",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.4.4",
                  "product_id": "T039001"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.4",
                "product": {
                  "name": "Fortinet FortiOS 7.4.4",
                  "product_id": "T039001-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.8",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.2.8",
                  "product_id": "T039002"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.8",
                "product": {
                  "name": "Fortinet FortiOS 7.2.8",
                  "product_id": "T039002-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.2.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.14",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.0.14",
                  "product_id": "T039003"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.14",
                "product": {
                  "name": "Fortinet FortiOS 7.0.14",
                  "product_id": "T039003-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.0.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.9",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.2.9",
                  "product_id": "T039004"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.9",
                "product": {
                  "name": "Fortinet FortiOS 7.2.9",
                  "product_id": "T039004-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.2.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.6",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.6",
                  "product_id": "T039005"
                }
              },
              {
                "category": "product_version",
                "name": "7.6",
                "product": {
                  "name": "Fortinet FortiOS 7.6",
                  "product_id": "T039005-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FortiOS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.4",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.4.4",
                  "product_id": "T039006"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.4",
                "product": {
                  "name": "Fortinet FortiProxy 7.4.4",
                  "product_id": "T039006-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.10",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.2.10",
                  "product_id": "T039007"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.10",
                "product": {
                  "name": "Fortinet FortiProxy 7.2.10",
                  "product_id": "T039007-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.2.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.17",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.0.17",
                  "product_id": "T039008"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.17",
                "product": {
                  "name": "Fortinet FortiProxy 7.0.17",
                  "product_id": "T039008-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.0.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FortiProxy"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-50176",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiOS. Dieser Fehler existiert wegen einer unsachgem\u00e4\u00dfen Sitzungsverarbeitung in der SAML-Authentifizierungskomponente. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er einen gef\u00e4lschten SAML-Authentifizierungslink sendet, der es ihm erm\u00f6glicht, die Sitzung des Benutzers zu entf\u00fchren und unberechtigten Zugriff zu erhalten. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039001",
          "T039003",
          "T039002"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2023-50176"
    },
    {
      "cve": "CVE-2024-33510",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiOS und FortiProxy. Dieser Fehler existiert wegen der unsachgem\u00e4\u00dfen Neutralisierung spezieller Elemente in der SSL-VPN-Web-Benutzeroberfl\u00e4che. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er manipulierte Anfragen sendet, um Phishing-Versuche durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039001",
          "T039007",
          "T039006",
          "T039008",
          "T039003",
          "T039002",
          "T039005",
          "T039004"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-33510"
    }
  ]
}

wid-sec-w-2024-3438

Vulnerability from csaf_certbund

Published

2024-11-12 23:00

Modified

2024-11-12 23:00

Summary

Fortinet FortiOS undFortiProxy: Mehrere Schwachstellen

Notes

Produktbeschreibung

FortiOS ist ein gehärtetes Betriebssystem für FortiGate Plattformen. FortiProxy ist eine Web-Proxy Lösung.

Angriff

Ein anonymer Angreifer kann mehrere Schwachstellen in Fortinet FortiOS und Fortinet FortiProxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Phishing-Angriffe durchzuführen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "FortiOS ist ein geh\u00e4rtetes Betriebssystem f\u00fcr FortiGate Plattformen.\r\nFortiProxy ist eine Web-Proxy L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein anonymer Angreifer kann mehrere Schwachstellen in Fortinet FortiOS und Fortinet FortiProxy ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Phishing-Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3438 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3438.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3438 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3438"
      },
      {
        "category": "external",
        "summary": "FortiGuard PSIRT Advisory FG-IR-23-475 vom 2024-11-12",
        "url": "https://www.fortiguard.com/psirt/FG-IR-23-475"
      },
      {
        "category": "external",
        "summary": "FortiGuard PSIRT Advisory FG-IR-24-033 vom 2024-11-12",
        "url": "https://www.fortiguard.com/psirt/FG-IR-24-033"
      }
    ],
    "source_lang": "en-US",
    "title": "Fortinet FortiOS undFortiProxy: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-12T23:00:00.000+00:00",
      "generator": {
        "date": "2024-11-13T11:47:45.933+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-3438",
      "initial_release_date": "2024-11-12T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-12T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.4",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.4.4",
                  "product_id": "T039001"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.4",
                "product": {
                  "name": "Fortinet FortiOS 7.4.4",
                  "product_id": "T039001-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.8",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.2.8",
                  "product_id": "T039002"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.8",
                "product": {
                  "name": "Fortinet FortiOS 7.2.8",
                  "product_id": "T039002-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.2.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.14",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.0.14",
                  "product_id": "T039003"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.14",
                "product": {
                  "name": "Fortinet FortiOS 7.0.14",
                  "product_id": "T039003-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.0.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.9",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.2.9",
                  "product_id": "T039004"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.9",
                "product": {
                  "name": "Fortinet FortiOS 7.2.9",
                  "product_id": "T039004-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.2.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.6",
                "product": {
                  "name": "Fortinet FortiOS \u003c7.6",
                  "product_id": "T039005"
                }
              },
              {
                "category": "product_version",
                "name": "7.6",
                "product": {
                  "name": "Fortinet FortiOS 7.6",
                  "product_id": "T039005-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:fortinet:fortios:7.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FortiOS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.4",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.4.4",
                  "product_id": "T039006"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.4",
                "product": {
                  "name": "Fortinet FortiProxy 7.4.4",
                  "product_id": "T039006-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.10",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.2.10",
                  "product_id": "T039007"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.10",
                "product": {
                  "name": "Fortinet FortiProxy 7.2.10",
                  "product_id": "T039007-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.2.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.17",
                "product": {
                  "name": "Fortinet FortiProxy \u003c7.0.17",
                  "product_id": "T039008"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.17",
                "product": {
                  "name": "Fortinet FortiProxy 7.0.17",
                  "product_id": "T039008-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:fortinet:fortiproxy:7.0.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "FortiProxy"
          }
        ],
        "category": "vendor",
        "name": "Fortinet"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-50176",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiOS. Dieser Fehler existiert wegen einer unsachgem\u00e4\u00dfen Sitzungsverarbeitung in der SAML-Authentifizierungskomponente. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er einen gef\u00e4lschten SAML-Authentifizierungslink sendet, der es ihm erm\u00f6glicht, die Sitzung des Benutzers zu entf\u00fchren und unberechtigten Zugriff zu erhalten. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039001",
          "T039003",
          "T039002"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2023-50176"
    },
    {
      "cve": "CVE-2024-33510",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Fortinet FortiOS und FortiProxy. Dieser Fehler existiert wegen der unsachgem\u00e4\u00dfen Neutralisierung spezieller Elemente in der SSL-VPN-Web-Benutzeroberfl\u00e4che. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, indem er manipulierte Anfragen sendet, um Phishing-Versuche durchzuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039001",
          "T039007",
          "T039006",
          "T039008",
          "T039003",
          "T039002",
          "T039005",
          "T039004"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-33510"
    }
  ]
}

CERTFR-2024-AVI-0979

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Fortinet. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Fortinet	FortiProxy	FortiProxy versions 7.4.x antérieures à 7.4.4
Fortinet	FortiAnalyzer	FortiAnalyzer-BigData versions antérieures à 7.4.1
Fortinet	FortiPortal	FortiPortal versions antérieures à 7.0.9
Fortinet	FortiWeb	FortiWeb versions antérieures à 7.4.4
Fortinet	FortiClient	FortiClientWindows versions 7.4.x antérieures à 7.4.1
Fortinet	FortiManager	FortiManager Cloud toutes versions
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.2.10
Fortinet	FortiAnalyzer	FortiAnalyzer Cloud versions antérieures à 7.2.7
Fortinet	FortiPAM	FortiPAM versions antérieures à 1.3
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.2.x antérieures à 7.2.4
Fortinet	FortiAnalyzer	FortiAnalyzer versions antérieures à 7.4.3
Fortinet	FortiAnalyzer	FortiAnalyzer Cloud versions 7.4.x antérieures à 7.4.3
Fortinet	FortiPortal	FortiPortal versions 7.4.x antérieures à 7.4.1
Fortinet	FortiManager	FortiManager versions antérieures à 7.4.3
Fortinet	FortiSwitchManager	FortiSwitchManager versions 7.0.x antérieures à 7.0.4
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.4
Fortinet	FortiClient	FortiClientWindows versions antérieures à 7.0.13
Fortinet	FortiClient	FortiClientMac versions 7.4.x antérieures à 7.4.1
Fortinet	FortiClient	FortiClientWindows versions 7.2.x antérieures à 7.2.5
Fortinet	FortiClient	FortiClientMac versions 7.2.x antérieures à 7.2.5
Fortinet	FortiOS	FortiOS versions antérieures à 7.0.15
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.9
Fortinet	FortiWeb	FortiWeb versions 7.6.x antérieures à 7.6.1

References

Title

Publication Time

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2023-50176 (GCVE-0-2023-50176)

Vulnerability from cvelistv5

Vulnerability from github

Vulnerability from csaf_cisa

Vulnerability from csaf_siemens

Vulnerability from gsd

Vulnerability from fkie_nvd

Vulnerability from cnvd

Vulnerability from csaf_certbund

Vulnerability from csaf_certbund

Vulnerability from certfr_avis

Solutions

Tags

Sightings

Nomenclature