Log in Start free

Vulnerability · Published Sep 10, 2024 · Assigned by fortinet

CVE-2024-36511

Low 3.4

In plain English

A low-severity security flaw in FortiADC from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)3.4Low
Exploit odds (30 days)0.4%top 68.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature

Affected products (as reported)

VendorProductVersions
Fortinet FortiADC 7.4.0 – through 7.4.47.2.0 – through 7.2.77.1.0 – through 7.1.47.0.0 – through 7.0.56.2.0 – through 6.2.66.1.0 – through 6.1.66.0.0 – through 6.0.4

Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:R

References