Details of VAR-202407-2006

ID

VAR-202407-2006

CVE

CVE-2024-23663

TITLE

fortinet's FortiExtender Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2024-007699

DESCRIPTION

An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allows an attacker to create users with elevated privileges via a crafted HTTP request. fortinet's FortiExtender There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Fortinet FortiExtender is a wireless WAN (Wide Area Network) extender device from Fortinet, an American company. Fortinet FortiExtender has an access control error vulnerability, which is caused by improper access control

Trust: 2.16

sources: NVD: CVE-2024-23663 // JVNDB: JVNDB-2024-007699 // CNVD: CNVD-2024-37340

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-37340

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.2.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.2.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	4.1.9	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	4.2.6	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	7.4.2	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.1.1	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.4.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	7.2.4	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lte	version:	7.0.4	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	eq	version:	5.3.2	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 7.2.0 to 7.2.4	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 7.0.0 to 7.0.4	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 4.1.1 to 4.1.9	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 5.3.2	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	-	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 4.2.0 to 4.2.6	Trust: 0.8
vendor:	フォーティネット	model:	fortiextender	scope:	eq	version:	fortiextender firmware 7.4.0 to 7.4.2	Trust: 0.8
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.4.0,<=7.4.2	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.2.0,<=7.2.4	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.0.0,<=7.0.4	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.2.0,<=4.2.6	Trust: 0.6
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.1.1,<=4.1.9	Trust: 0.6

sources: CNVD: CNVD-2024-37340 // JVNDB: JVNDB-2024-007699 // NVD: CVE-2024-23663

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2024-23663
value:	HIGH
Trust: 1.0
psirt@fortinet.com:	CVE-2024-23663
value:	HIGH
Trust: 1.0
NVD:	CVE-2024-23663
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2024-37340
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-37340
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2024-23663
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 2.0
NVD:	CVE-2024-23663
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-37340 // JVNDB: JVNDB-2024-007699 // NVD: CVE-2024-23663 // NVD: CVE-2024-23663

PROBLEMTYPE DATA

problemtype:	CWE-284	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-007699 // NVD: CVE-2024-23663

PATCH

title:	FG-IR-23-459	url:	https://fortiguard.com/psirt/FG-IR-23-459	Trust: 0.8
title:	Patch for Fortinet FortiExtender Access Control Error Vulnerability (CNVD-2024-37340)	url:	https://www.cnvd.org.cn/patchInfo/show/587496	Trust: 0.6

sources: CNVD: CNVD-2024-37340 // JVNDB: JVNDB-2024-007699

EXTERNAL IDS

db:	NVD	id:	CVE-2024-23663	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-007699	Trust: 0.8
db:	CNVD	id:	CNVD-2024-37340	Trust: 0.6

sources: CNVD: CNVD-2024-37340 // JVNDB: JVNDB-2024-007699 // NVD: CVE-2024-23663

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2024-23663	Trust: 1.4
url:	https://fortiguard.com/psirt/fg-ir-23-459	Trust: 1.0

sources: CNVD: CNVD-2024-37340 // JVNDB: JVNDB-2024-007699 // NVD: CVE-2024-23663

SOURCES

db:	CNVD	id:	CNVD-2024-37340
db:	JVNDB	id:	JVNDB-2024-007699
db:	NVD	id:	CVE-2024-23663

LAST UPDATE DATE

2024-09-11T22:39:48.913000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-37340	date:	2024-09-04T00:00:00
db:	JVNDB	id:	JVNDB-2024-007699	date:	2024-09-10T05:23:00
db:	NVD	id:	CVE-2024-23663	date:	2024-09-09T16:05:49.647

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-37340	date:	2024-09-04T00:00:00
db:	JVNDB	id:	JVNDB-2024-007699	date:	2024-09-10T00:00:00
db:	NVD	id:	CVE-2024-23663	date:	2024-07-09T16:15:04.593