- Fortinet found an escalation of privilege errors in several versions of Fortiswitch
- The error got a critical difficulty
- A patch and a mitigation measure are both available
Fortinet has patched a critical severity of Fortiswitch, which enabled malicious actors to change users’ login credentials.
In a short security advice published earlier this week, the company detailed the company the escalation of privilege errors, versions of Fortiswitch that were affected, and suggested a solution for those who could not patch things right away.
The error is tracked as SWE-620 and got a severity of 9.3/10 (critical). Per NVD is tracked as CVE-2024-48887 and has an even worse difficulty-degree-9.8/10. Apparently, the error was found in the password reset form, which can also be forced to provide the original password.
Works around the error
“Do not use” Forgot password “functionality,” explained Mitre Corporation in his advice. “But if you need to, make sure you only provide information to the actual user, for example by using an E -email address or challenge question that the legitimate user has already specified in the past; do not let the current user change this identity information before the correct password is specified.”
Affected versions include Fortiswitch 6.4 to 6.4.14, 7.0 to 7.0.10, 7.2 to 7.2.8, 7.4 to 7.4.4 and 7.6. Users need to upgrade to the latest version of the tool to mitigate the error.
Those who cannot use the corrections are advised immediately to insert the solution instead and disable HTTP/HTTPS access from administrative interfaces.
Fortinet Fortiswitch is a family of safe, high-performance ethernet switches designed to integrate tightly with the safety substance of the fort, especially Fortigate Firewalls. It is mostly used in business environments, making it a much sought after goal. Firewalls, Switches and Hubs are a fantastic springboard into the entire target network and towards larger, bold goals.
Via Hacker the news