Fortinet Urges Patches for Exploited FortiWeb Flaws

Fortinet has urged users of its FortiWeb web application firewall to apply security patches immediately after confirming active exploitation of two vulnerabilities that could allow attackers to gain unauthorized control over affected systems.

The company disclosed the flaws on Tuesday, noting that both have been observed in real-world attacks. The more severe issue, tracked as CVE-2024-64446, stems from a relative path traversal vulnerability in the product's graphical user interface. It carries a CVSS severity score of 9.1 and affects FortiWeb versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. An unauthenticated attacker could exploit the flaw by sending specially crafted HTTP or HTTPS requests to execute administrative commands, potentially creating unauthorized administrator accounts and bypassing normal authentication checks.

Exploitation of CVE-2024-64446 has been underway since early October 2024, with attacks originating from IP addresses in North America, Europe, and Asia. Security researchers have reported proof-of-concept exploits circulating publicly, enabling attackers to disable firewall rules,...