CVE-2024-45327CWE-307
An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3…
High · published September 11, 2024
What it is
An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3 change password endpoint may allow an authenticated attacker to perform a brute force attack on users and administrators password via crafted HTTP requests.
The record
Technical detail
- CVSS v3.1
- 7.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
- CVSS v4.0
- Not supplied
- EPSS
- 0.00340 · 26.3th percentile
- Weakness
- CWE-307 · Improper Restriction of Excessive Authentication Attempts
- Published
- 2024-09-11T09:53Z
EPSS history
Timeline
11 SEP 09:53Z
An improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0 through 7.3.2, 7.2.0 through 7.2.2, 7.0.0 through 7.0.3…
cvelistv5