Security Resilience

CVE-2024-23666

Fortinet Fortianalyzer 6.4.0 – 6.4.15

Published
12 November 2024
Modified
21 January 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.027 86th percentile
Risk Priority 64 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-23666 is a high-severity Client-Side Enforcement of Server-Side Security (CWE-602) vulnerability in Fortinet Fortianalyzer. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 14% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-23666 is a client-side enforcement of server-side security flaw, tracked under CWE-602, that permits improper access control in multiple Fortinet products. Affected components include FortiAnalyzer-BigData versions 7.4.0 and 7.2.0 through 7.2.6, 7.0.1 through 7.0.6, 6.4.5 through 6.4.7, and 6.2.5; FortiManager versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, and 6.4.0 through 6.4.14; and FortiAnalyzer versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, and 6.4.0 through 6.4.14. The issue carries a CVSS 3.1 score of 7.5.

An authenticated attacker with network access can submit crafted requests to bypass intended server-side controls and obtain high-impact access to confidentiality, integrity, and availability. Exploitation requires low attack complexity once low-privileged credentials are obtained and does not depend on user interaction.

The Fortinet advisory FG-IR-23-396 addresses the vulnerability. Current EPSS stands at 0.0813 after reaching a peak of 0.1029.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11…

more

and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests.

CWE(s)
CWE-602NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2023-42787Same product: Fortinet Fortianalyzer
CVE-2024-32123Same product: Fortinet Fortianalyzer
CVE-2024-31496Same product: Fortinet Fortianalyzer
CVE-2023-44255Same product: Fortinet Fortianalyzer
CVE-2024-32116Same product: Fortinet Fortianalyzer
CVE-2024-32117Same product: Fortinet Fortianalyzer
CVE-2024-35274Same product: Fortinet Fortianalyzer
CVE-2023-44254Same product: Fortinet Fortianalyzer
CVE-2024-33501Same product: Fortinet Fortianalyzer
CVE-2024-32118Same product: Fortinet Fortianalyzer

Affected Assets

fortinet
fortianalyzer
6.4.0 — 6.4.15 · 7.0.0 — 7.0.13 · 7.2.0 — 7.2.6
fortinet
fortianalyzer big data
7.4.0 · 6.2.1 — 7.2.7
fortinet
fortimanager
6.4.0 — 6.4.15 · 7.0.0 — 7.0.13 · 7.2.0 — 7.2.6

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-25 Reference Monitor good match

Requires a tamper-proof, always-invoked reference monitor that cannot be bypassed by client-side logic.

AC-3 Access Enforcement good match

Enforces all access decisions on the server according to policy rather than trusting client-supplied enforcement.

AC-4 Information Flow Enforcement good match

Enforces information-flow rules at the server boundary instead of delegating them to the client.

SC-7 Boundary Protection partial match

Monitors and controls all external and key internal interfaces so that server-side policy cannot be off-loaded to clients.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle mandates server-side validation and prevents reliance on client enforcement.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly call for server-side enforcement of security mechanisms.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles discourage client-side trust but do not directly address this weakness.

A.8.28 Secure coding partial match
prevents

Secure coding standards require server-side checks and reject client-only enforcement.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect client-side enforcement but is not the primary mitigation.

A.8.3 Information access restriction partial match
blocks

Information access restriction is undermined when the client is trusted to enforce it.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-602, a class-level weakness, and none of its children carries one either.

References