Fortinet Family (FortiADC, FortiExtender) Security Update Recommendations
Overview
An update has been made available to fix vulnerabilities in Fortinet products. Users of affected versions are advised to update to the latest version.
Affected Products
Cve-2024-27784, cve-2024-27783, cve-2024-27782
- FortiAIOps 2.0 version: 2.0.0
CVE-2023-50178
- FortiADC 7.4 version: 7.4.0
- FortiADC 7.2 versions: 7.2.0 (inclusive) ~ 7.2.3 (inclusive)
- FortiADC 7.1 versions: 7.1 All
- FortiADC 7.0 version: 7.0 All
- FortiADC 6.2 version: 6.2 All
- FortiADC 6.1 version: 6.1 All
- FortiADC 6.0 version: 6.0 All
CVE-2024-23663
- FortiExtender 7.4 versions: 7.4.0 (inclusive) ~ 7.4.2 (inclusive)
- FortiExtender 7.2 versions: 7.2.0 (inclusive) ~ 7.2.4 (inclusive)
- FortiExtender 7.0 versions: 7.0.0 (inclusive) ~ 7.0.4 (inclusive)
Resolved Vulnerabilities
Vulnerability that could allow an authenticated remote attacker to retrieve sensitive information from the API endpoint or log files (CVE-2024-27784 )
CSRF vulnerability allows an unauthenticated remote attacker to execute arbitrary actions on behalf of an authenticated user by tricking the victim into executing a malicious GET request (CVE-2024-27783)
A session expiration vulnerability could allow an attacker to reuse an existing stolen session token to perform unauthorized actions via crafted requests (CVE-2024-27782)
Improper certificate validation vulnerability that could allow remote and unauthenticated attackers to conduct man-in-the-middle attacks against various remote servers and device-to-device communication channels, such as private SDN connectors and FortiToken Cloud (CVE-2023-50178)
Vulnerability Patches
Vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.
Cve-2024-27784, cve-2024-27783, cve-2024-27782
- FortiAIOps 2.0 versions: 2.0.1 and later versions
CVE-2023-50178
- FortiADC 7.4 versions: 7.4.1 and later
- FortiADC 7.2 versions: 7.2.4 and later
- FortiADC 7.1 version: Migrate to a fixed release
- FortiADC 7.0 version: Migrate to a fixed release
- FortiADC 6.2 version: Migrate to a fixed release
- FortiADC 6.1 version: Migrate to a fixed release
- FortiADC 6.0 version: Migrate to a fixed release
CVE-2024-23663
- FortiExtender 7.4 version: 7.4.3
- FortiExtender 7.2 version: 7.2.5
- FortiExtender 7.0 version: 7.0.5
Referenced Sites
[1] CVE-2024-27784 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-27784
[2] FortiAIOps – Sensitive Information leak to an Unauthorized Actor
https://fortiguard.fortinet.com/psirt/FG-IR-24-072
[3] CVE-2024-27783 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-27783
[4] FortiAIOps – Cross-site request forgery
https://fortiguard.fortinet.com/psirt/FG-IR-24-070
[5] CVE-2024-27782 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-27782
[6] FortiAIOps – Improper Session Management
https://fortiguard.fortinet.com/psirt/FG-IR-24-069
[7] CVE-2023-50178 Detail
https://nvd.nist.gov/vuln/detail/CVE-2023-50178
[8] Multiple lack of client-side certificate validation when establishing secure connections
https://fortiguard.fortinet.com/psirt/FG-IR-22-298
[9] CVE-2024-23663 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-23663
[10] Privilege escalation from low privilege administrator