{"id":"CVE-2024-55594","aliases":["EUVD-2024-54079","GHSA-x5rc-p5hc-wc9m"],"status":"published","title":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7...","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00525,"percentile":0.4504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-228"],"published":"2025-03-14T16:25:33Z","modified":"2026-06-17T08:11:17Z","products":[{"vendor":"fortinet","product":"fortiweb"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-115","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55594"},{"url":"https://github.com/advisories/GHSA-x5rc-p5hc-wc9m"}],"sources":{"cve":[{"id":"CVE-2024-55594","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-14T16:25:33.078Z","modified":"2025-03-14T16:58:29.982Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium","assessor":"cna"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-54079","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-14T16:25:33Z","modified":"2025-03-14T16:58:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X","level":"medium"}],"updated_at":"2026-11-02T20:53:02.719002Z"}],"ghsa":[{"id":"GHSA-x5rc-p5hc-wc9m","title":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7...","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-14T18:30:50Z","modified":"2025-03-14T18:30:57Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T15:00:17.776608Z"}],"nvd":[{"id":"CVE-2024-55594","description":"An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.","status":"published","published":"2025-03-14T17:15:48.653Z","modified":"2026-06-17T08:11:17.803Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-228"],"updated_at":"2026-11-02T14:10:45.422466Z"}]}}