PT-2025-6258 · Fortinet · Fortianalyzer+1
Publicado
2025-02-11
·
Atualizado
2025-02-13
·
CVE-2024-36508
CVSS v2.0
6.2
Média
| Vetor | AV:L/AC:L/Au:S/C:N/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Fortinet FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5
Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5
Description:
The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability. This allows an authenticated admin user with diagnose privileges to delete files on the system via the CLI. The vulnerability can be exploited to gain read, modify, or delete access to data.
Recommendations:
For Fortinet FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5, update to a version that includes the fix for this issue.
For Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and prior to 7.2.5, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the CLI for authenticated admin users with diagnose privileges until a patch is available.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fortianalyzer
Fortimanager