CVE-2024-33509

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 7.2.0, <= 7.2.1; >= 7.0.0, <= 7.0.10; >= 6.4.0, <= 6.4.3; >= 6.3.0, <= 6.3.23
fortinet	fortiweb	7.2.0; 7.0.0; 6.4.0; 6.3.0

References

https://fortiguard.fortinet.com/psirt/FG-IR-22-326Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-22-326Vendor Advisory

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-33519.8A vulnerability, which was classified as critical, was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affec CVE-2024-335104.3An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS vers CVE-2024-335119.8There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execut CVE-2024-335129.8There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated rem CVE-2024-335135.9Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335147.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335157.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335167.5An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. Suc CVE-2024-335177.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Succe CVE-2024-335185.3An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Succe CVE-2024-335197.2A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote CVE-2024-33529.8A vulnerability has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0 and classified as critical. This vulnerab