CVE-2024-27782 | FortiAIOps - Web Interface Operational Intel

Executive Risk Summary

"A vulnerability in Fortinet FortiAIOps 2.0.0 allows an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests, potentially leading to unauthorized access and data breaches. This vulnerability is classified as a critical risk due to the potential for significant data integrity and confidentiality impacts."

Operational Audit Arsenal

Target Type Firmware Image

Target Asset FortiAIOps

Standard Path Global Firmware

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

CVE-2024-27782: Insufficient session expiration vulnerability in FortiAIOps 2.0.0, potentially allowing unauthorized access via stolen session tokens. Verify version and apply patch according to Fortinet advisory FG-IR-24-069.

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-24-069

Scope of Impact

Fortinet Fortiaiops (Version 2.0.0)

Original NVD Description

"Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-34992 CVSS 10

FortiGate - API

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.