Twin Max-Severity Bugs Open Fortinet's SIEM to Code Execution
Full 10s on the CVSS vulnerability severity scale have been assigned to two flaws discovered in Fortinet's FortiSIEM cybersecurity operations platform.
February 6, 2024
![Fortinet sign on office building Fortinet sign on office building](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt49dd1ad12cf742cc/65c279901be81b040a5c0e03/Fortinet_Thomas_Kyhn_Alamy_Stock_Photo.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Two critical vulnerabilities in Fortinet's FortiSIEM product have been assigned provisional CVSS scores of 10. However, details about the bugs remain scant.
What is known is that the vulnerabilities, tracked under CVE-2024-23108 and CVE-2024-23109, are command injection flaws that could potentially let threat actors use crafted API requests to execute unauthorized code.
FortiSIEM is Fortinet's security information and event management (SIEM) platform, used for enabling enterprise cybersecurity operations centers.
FortiSIEM versions impacted by the flaws include version 7.1.0 through 7.1.1; 7.0.0 through 7.0.2; 6.7.0 through 6.7.8; 6.6.0 through 6.6.3; 6.5.0 through 6.5.2; and 6.4.0 through 6.4.2, according to the CVE entries.
The link Fortinet provided for information on the flaws leads to a write-up on another FortiSIEM vulnerability from October 2023, suggesting there might be a link between that bug and these new discoveries. The previous flaw was assigned a CVSS score of 9.7.
Dark Reading asked Fortinet for additional details but has not yet received a response.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024