{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2024-017.pdf"
    },
    "title": "Critical Vulnerabilites in FortiSIEM",
    "serial_number": "2024-017",
    "publish_date": "06-02-2024 20:55:18",
    "description": "In February 2024, Fortinet quietly updated a 2023 advisory, joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. If exploited, these vulnerabilities could allow a remote unauthenticated attacker to execute commands on the system.<br>\nUpdating is recommended as soon as possible.<br>\n",
    "url_title": "2024-017",
    "content_markdown": "---\ntitle: 'Critical Vulnerabilites in\u00a0FortiSIEM'\nnumber: '2024-017'\nversion: '1.0'\noriginal_date: 'February 6, 2024'\ndate: 'February 6, 2024'\n---\n\n_History:_\n\n* _06/02/2024 --- v1.0 -- Initial publication_\n\n# Summary\n\nIn February 2024, Fortinet quietly updated a 2023 advisory [1], joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. If exploited, these vulnerabilities could allow a remote unauthenticated attacker to execute commands on the system.\n\nUpdating is recommended as soon as possible.\n\n# Technical Details\n\nThe vulnerabilities **CVE-2024-23108** and **CVE-2024-23109**, both with a provisional **CVSS score of 10 out of 10**, are due to improper neutralisation of special elements. By sending crafted API requests, a remote unauthenticated attacker could execute commands on the affected system.\n\nOn October 10, 2023, Fortinet released the initial version of the advisory regarding a similar vulnerability tracked as **CVE-2023-34992** with a **CVSS score 9.7**.\n\n# Affected Products\n\nThe following product versions are affected:\n\n- version 7.1.0 through 7.1.1 (fixed in 7.1.2);\n- version 7.0.0 through 7.0.2 (fixed in 7.0.3);\n- version 6.7.0 through 6.7.8 (fixed in 6.7.9);\n- version 6.6.0 through 6.6.3 (fixed in 6.6.5);\n- version 6.5.0 through 6.5.2 (fixed in 6.5.3);\n- version 6.4.0 through 6.4.2 (fixed in 6.4.4).\n\n# Recommendations\n\nCERT-EU recommends upgrading to a non-vulnerable version of the product.\n\n# References\n\n[1] <https://www.fortiguard.com/psirt/FG-IR-23-130>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>06/02/2024 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>In February 2024, Fortinet quietly updated a 2023 advisory [1], joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. If exploited, these vulnerabilities could allow a remote unauthenticated attacker to execute commands on the system.</p><p>Updating is recommended as soon as possible.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerabilities <strong>CVE-2024-23108</strong> and <strong>CVE-2024-23109</strong>, both with a provisional <strong>CVSS score of 10 out of 10</strong>, are due to improper neutralisation of special elements. By sending crafted API requests, a remote unauthenticated attacker could execute commands on the affected system.</p><p>On October 10, 2023, Fortinet released the initial version of the advisory regarding a similar vulnerability tracked as <strong>CVE-2023-34992</strong> with a <strong>CVSS score 9.7</strong>.</p><h2 id=\"affected-products\">Affected Products</h2><p>The following product versions are affected:</p><ul><li>version 7.1.0 through 7.1.1 (fixed in 7.1.2);</li><li>version 7.0.0 through 7.0.2 (fixed in 7.0.3);</li><li>version 6.7.0 through 6.7.8 (fixed in 6.7.9);</li><li>version 6.6.0 through 6.6.3 (fixed in 6.6.5);</li><li>version 6.5.0 through 6.5.2 (fixed in 6.5.3);</li><li>version 6.4.0 through 6.4.2 (fixed in 6.4.4).</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU recommends upgrading to a non-vulnerable version of the product.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.fortiguard.com/psirt/FG-IR-23-130\">https://www.fortiguard.com/psirt/FG-IR-23-130</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}