CVE-2024-55592

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

An incorrect authorization vulnerability [CWE-863] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions, may allow an authenticated attacker to perform unauthorized operations on incidents via crafted HTTP requests.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Fortinet	FortiSIEM	>= 7.2.0, <= 7.2.5; >= 7.1.0, <= 7.1.7; >= 7.0.0, <= 7.0.3; >= 6.7.0, <= 6.7.9; >= 6.6.0, <= 6.6.5; >= 6.5.0, <= 6.5.3; >= 6.4.0, <= 6.4.4; >= 6.3.0, <= 6.3.3; >= 6.2.0, <= 6.2.1; >= 6.1.0, <= 6.1.2; 5.4.0; >= 5.3.0, <= 5.3.3

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-377Vendor Advisory

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-555932.7A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWeb versions 6.3.17 through 7.6.1 al CVE-2024-555949.8An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 CVE-2024-555977.2A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows at CVE-2024-555995.3An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all ver CVE-2024-55607.5CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a s CVE-2024-556015.3Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal CVE-2024-556028.5PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able t CVE-2024-556036.5Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though t CVE-2024-556044.3Appsmith is a platform to build admin panels, internal tools, and dashboards. Users invited as "App Viewer" should not have access to develo CVE-2024-556057.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a larg CVE-2024-55614.8The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2024-556265.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, a larg