PT-2024-8519 · Fortinet · Fortianalyzer+2

Published 2024-11-12 · Updated 2025-01-17 · CVE-2024-32118

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and before 7.2.5 Fortinet FortiAnalyzer-BigData before 7.4.0

Description The issue is related to improper neutralization of special elements used in an OS command, allowing an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. This can be achieved by sending specially crafted requests to the CLI interface.

Recommendations For Fortinet FortiManager versions 7.4.0 through 7.4.2 and before 7.2.5, update to a version that includes the fix for this issue. For Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and before 7.2.5, update to a version that includes the fix for this issue. For Fortinet FortiAnalyzer-BigData before 7.4.0, update to version 7.4.0 or later. As a temporary workaround, consider restricting access to the CLI interface to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-10079

CVE-2024-32118

Affected Products

Fortianalyzer

Fortianalyzer-Bigdata

Fortimanager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-32118 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32118 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-116 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10079 · Security Note
• https://twitter.com/VulmonFeeds/status/1856543201751859237 · Twitter Post
• https://twitter.com/CVEnew/status/1856717973165109284 · Twitter Post
• https://t.me/cvenotify/107823 · Telegram Post