PT-2024-25282 · Fortinet · Fortianalyzer+1
Published
2024-11-12
·
Updated
2025-01-31
·
CVE-2024-33505
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
FortiAnalyzer versions 6.4.0 through 6.4.14
FortiAnalyzer versions 7.0.0 through 7.0.12
FortiAnalyzer versions 7.2.0 through 7.2.5
FortiAnalyzer versions 7.4.0 through 7.4.2
FortiManager versions 6.4.0 through 6.4.14
FortiManager versions 7.0.0 through 7.0.12
FortiManager versions 7.2.0 through 7.2.5
FortiManager versions 7.4.0 through 7.4.2
Description
The issue is related to a heap-based buffer overflow in the Command Line Interface (CLI) of Fortinet FortiManager and FortiAnalyzer. This can allow a remote attacker to escalate their privileges via specially crafted HTTP requests.
Recommendations
For FortiAnalyzer versions 6.4.0 through 6.4.14, update to a version outside of this range to resolve the issue.
For FortiAnalyzer versions 7.0.0 through 7.0.12, update to a version outside of this range to resolve the issue.
For FortiAnalyzer versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue.
For FortiAnalyzer versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue.
For FortiManager versions 6.4.0 through 6.4.14, update to a version outside of this range to resolve the issue.
For FortiManager versions 7.0.0 through 7.0.12, update to a version outside of this range to resolve the issue.
For FortiManager versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue.
For FortiManager versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue.
Fix
Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fortianalyzer
Fortimanager