Skip to content

Commit

Permalink
Format markdown docs
Browse files Browse the repository at this point in the history
  • Loading branch information
DamoOne authored and github-actions[bot] committed Jan 15, 2025
1 parent 15fa146 commit 386666c
Showing 1 changed file with 5 additions and 7 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,12 @@

Fortinet has identified an Authentication Bypass vulnerability using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy, which may allow remote attackers to gain super-admin privileges via crafted requests to Node.js websocket module.


## What is vulnerable?

| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
| ------------------- | ----------------------- | ----------------------------------------------------------------- | ------------ | -------------- |
| FortiOS 7.0 | 7.0.0 through 7.0.16 | [CVE-2024-55591](https://nvd.nist.gov/vuln/detail/CVE-2024-55591) | 9.6 | **Critical** |
| FortiProxy 7.0<br>FortiProxy 7.2 | 7.0.0 through 7.0.19<br>7.2.0 through 7.2.12 | [CVE-2024-55591](https://nvd.nist.gov/vuln/detail/CVE-2024-55591) | 9.6 | **Critical** |

| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
| -------------------------------- | -------------------------------------------- | ----------------------------------------------------------------- | ---- | ------------ |
| FortiOS 7.0 | 7.0.0 through 7.0.16 | [CVE-2024-55591](https://nvd.nist.gov/vuln/detail/CVE-2024-55591) | 9.6 | **Critical** |
| FortiProxy 7.0<br>FortiProxy 7.2 | 7.0.0 through 7.0.19<br>7.2.0 through 7.2.12 | [CVE-2024-55591](https://nvd.nist.gov/vuln/detail/CVE-2024-55591) | 9.6 | **Critical** |

## Recommendation

Expand All @@ -22,4 +20,4 @@ The WA SOC recommends administrators apply the solutions as per vendor instructi
## Additional References

- Tenable: <https://www.tenable.com/blog/cve-2024-55591-fortinet-authentication-bypass-zero-day-vulnerability-exploited-in-the-wild>
- ACSC: <https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/fortios-fortiproxy-authentication-bypass-nodejs-websocket-module-vulnerability>
- ACSC: <https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/fortios-fortiproxy-authentication-bypass-nodejs-websocket-module-vulnerability>

0 comments on commit 386666c

Please sign in to comment.