PT-2024-7305 · Fortinet · Fortianalyzer

Published 2024-10-07 · Updated 2024-10-19 · CVE-2024-45330

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 7.2.2 through 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3

Description: The issue is related to the use of an externally-controlled format string in the FortiAnalyzer event tracking and analysis tool. This could allow an attacker to escalate privileges via specially crafted requests, potentially enabling the execution of arbitrary code or commands.

Recommendations: For Fortinet FortiAnalyzer versions 7.2.2 through 7.2.5, update to a version outside of this range to mitigate the risk. For Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the fazsvcd daemon to minimize the risk of exploitation.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2024-08659

CVE-2024-45330

Affected Products

Fortianalyzer

References · 9

• https://fortiguard.fortinet.com/psirt/FG-IR-24-196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45330 · Security Note
• https://bdu.fstec.ru/vul/2024-08659 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45330 · Vendor Advisory
• https://t.me/cvedetector/7364 · Telegram Post
• https://twitter.com/cracbot/status/1845343823565815881 · Twitter Post
• https://twitter.com/CVEnew/status/1843672045097545783 · Twitter Post
• https://twitter.com/CharyyevPerman/status/1843871746811932995 · Twitter Post
• https://t.me/cvenotify/98828 · Telegram Post