New Fortinet FortiSIEM flaws evading patches for older RCE reported

Fortinet has reported that its FortiSIEM solution is impacted by two new vulnerabilities that circumvent fixes issued for a critical remote code execution flaw, tracked as CVE-2023-34992, after mistakenly disclosing the newly identified issues as duplicates of the older bug, according to BleepingComputer. Both new vulnerabilities, tracked as CVE-2024-23108 and CVE-2024-23109, are variants of the original bug and could all be exploited to facilitate unauthorized command execution through crafted API requests, said Fortinet. "The two new CVEs share the exact same description and score as the initial one; in parallel we updated MITRE. A reminder pointing to the updated Advisory will be included for our customers on Tuesday when Fortinet publishes its monthly advisory," Fortinet added. Organizations using FortiSIEM have been urged to upgrade to version 7.1.2 or above, as well as the upcoming version 6.4.4 or above, 6.5.3 or above, 6.6.5 or above, 6.7.9 or above, 7.0.3 or above, and 7.2.0 or above once they become available.