Vulnerability Description
A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to decrypt some secrets even if the 'private-data-encryption' setting is enabled.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortimanager | >= 6.4.0, < 7.2.10 |
| Fortinet | Fortimanager Cloud | >= 6.4.1, < 7.2.9 |
Related Weaknesses (CWE)
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-094Vendor Advisory
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-pgc3-Third Party Advisory
FAQ
What is CVE-2024-33504?
CVE-2024-33504 is a vulnerability with a CVSS score of 4.1 (MEDIUM). A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all version...
How severe is CVE-2024-33504?
CVE-2024-33504 has been rated MEDIUM with a CVSS base score of 4.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-33504?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortimanager, Fortinet Fortimanager Cloud.