CVE-2024-55592 - Vulnerability Details - OpenCVE

An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Fortinet	Fortisiem

Configuration 1 [-]

cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://fortiguard.fortinet.com/psirt/FG-IR-24-377

History

Fri, 25 Jul 2025 14:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:fortinet:fortisiem::::::::

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00021}`	epss `{'score': 0.00028}`

Tue, 11 Mar 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Mar 2025 15:00:00 +0000

Type	Values Removed	Values Added
Description		An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.
Weaknesses		CWE-863
References		https://fortiguard.fortinet.com/psirt/FG-IR-24-377
Metrics		cvssV3_1 `{'score': 3.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2025-03-11T14:54:29.067Z

Updated: 2025-03-11T16:07:03.773Z

Reserved: 2024-12-09T11:19:49.470Z

Link: CVE-2024-55592

Vulnrichment

Updated: 2025-03-11T16:06:59.576Z

NVD

Status : Analyzed

Published: 2025-03-11T15:15:43.823

Modified: 2025-07-25T14:25:49.140

Link: CVE-2024-55592

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-55592", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2024-12-09T11:19:49.470Z", "datePublished": "2025-03-11T14:54:29.067Z", "dateUpdated": "2025-03-11T16:07:03.773Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiSIEM", "cpes": [], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.5", "status": "affected"}, {"versionType": "semver", "version": "7.1.0", "lessThanOrEqual": "7.1.7", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.3", "status": "affected"}, {"versionType": "semver", "version": "6.7.0", "lessThanOrEqual": "6.7.9", "status": "affected"}, {"versionType": "semver", "version": "6.6.0", "lessThanOrEqual": "6.6.5", "status": "affected"}, {"versionType": "semver", "version": "6.5.0", "lessThanOrEqual": "6.5.3", "status": "affected"}, {"versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.4", "status": "affected"}, {"versionType": "semver", "version": "6.3.0", "lessThanOrEqual": "6.3.3", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.1", "status": "affected"}, {"versionType": "semver", "version": "6.1.0", "lessThanOrEqual": "6.1.2", "status": "affected"}, {"version": "5.4.0", "status": "affected"}, {"versionType": "semver", "version": "5.3.0", "lessThanOrEqual": "5.3.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-03-11T14:54:29.067Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "Improper access control", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSIEM version 7.3.0 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-377", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-377"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-11T16:06:54.927466Z", "id": "CVE-2024-55592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T16:07:03.773Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-55592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-11T16:06:54.927466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-11T16:06:59.576Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": [], "vendor": "Fortinet", "product": "FortiSIEM", "versions": [{"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.5"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.7"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.3"}, {"status": "affected", "version": "6.7.0", "versionType": "semver", "lessThanOrEqual": "6.7.9"}, {"status": "affected", "version": "6.6.0", "versionType": "semver", "lessThanOrEqual": "6.6.5"}, {"status": "affected", "version": "6.5.0", "versionType": "semver", "lessThanOrEqual": "6.5.3"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.4"}, {"status": "affected", "version": "6.3.0", "versionType": "semver", "lessThanOrEqual": "6.3.3"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.1"}, {"status": "affected", "version": "6.1.0", "versionType": "semver", "lessThanOrEqual": "6.1.2"}, {"status": "affected", "version": "5.4.0"}, {"status": "affected", "version": "5.3.0", "versionType": "semver", "lessThanOrEqual": "5.3.3"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please upgrade to FortiSIEM version 7.3.0 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-377", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-377"}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Improper access control"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-03-11T14:54:29.067Z"}}}, "cveMetadata": {"cveId": "CVE-2024-55592", "state": "PUBLISHED", "dateUpdated": "2025-03-11T16:07:03.773Z", "dateReserved": "2024-12-09T11:19:49.470Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2025-03-11T14:54:29.067Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}