Fortinet Security Updates – 10 July 2024

The addressed vulnerabilities could allow the remote attacker to perform cross-site scripting attacks, obtain sensitive information, create users with elevated privileges, or execute arbitrary code or commands and gain unauthorized access to the affected system by sending specially crafted requests.

Sample of the addressed vulnerabilities:

1. Fortinet FortiExtender Improper Access Control Vulnerability (CVE-2024-23663):

• CVSS: 8.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. Fortinet SSL VPN Web UI Cross-Site Scripting Vulnerability (CVE-2024-26006):

• CVSS: 6.9
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: Required
• Consequences: Cross-site scripting

Sample of the affected products:

• FortiOS.
• FortiProxy.
• FortiADC.
• FortiPortal.
• FortiWeb.
• FortiExtender.