Fortinet Security Updates – 15 May 2024

The addressed vulnerabilities could allow the remote attacker to perform denial of service attacks, execute arbitrary code, and gain access to the affected products by sending specially crafted HTTP requests.

Sample of the addressed vulnerabilities:

1. Fortinet FortiWebManager Code Execution Vulnerability (CVE-2024-3667):

• CVSS: 8.6
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. Fortinet FortiPortal Improper Access Control Vulnerability (CVE-2024-23105):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: None
• Consequences: Bypass Security

Sample of the affected products:

• FortiSwitchManager.
• FortiPortal.
• FortiSOAR.
• FortiADC.
• FortiAuthenticator.
• FortiProxy.
• FortiWebManager.