PT-2025-1319 · Fortinet · Fortianalyzer+1
Publicado
2025-01-14
·
Atualizado
2025-01-21
·
CVE-2024-33502
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:L/Au:S/C:N/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12
Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12
Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14
Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12
Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5
Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2
Description
The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', which allows an attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests. This can be achieved by sending a specially formed HTTP request. The vulnerability is associated with errors in processing the relative path to a directory.
Recommendations
For Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12, update to a version outside of this range to resolve the issue.
For Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12, update to a version outside of this range to resolve the issue.
For Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14, update to a version outside of this range to resolve the issue.
For Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12, update to a version outside of this range to resolve the issue.
For Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue.
For Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue.
As a temporary workaround, consider restricting access to the vulnerable directory to minimize the risk of exploitation.
Correção
Relative Path Traversal
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fortianalyzer
Fortimanager