CVE-2024-55592

Summary

An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiSIEM7.2.0 <= 7.2.5affected
FortinetFortiSIEM7.1.0 <= 7.1.7affected
FortinetFortiSIEM7.0.0 <= 7.0.3affected
FortinetFortiSIEM6.7.0 <= 6.7.9affected
FortinetFortiSIEM6.6.0 <= 6.6.5affected
FortinetFortiSIEM6.5.0 <= 6.5.3affected
FortinetFortiSIEM6.4.0 <= 6.4.4affected
FortinetFortiSIEM6.3.0 <= 6.3.3affected
FortinetFortiSIEM6.2.0 <= 6.2.1affected
FortinetFortiSIEM6.1.0 <= 6.1.2affected
FortinetFortiSIEM5.4.0affected
FortinetFortiSIEM5.3.0 <= 5.3.3affected

Weaknesses

  • CWE-863: Improper access control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References