PT-2025-10770 · Fortinet · Fortianalyzer+2
Published
2025-03-11
·
Updated
2025-03-12
·
CVE-2024-33501
CVSS v3.1
6.7
Medium
| Vector | AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
FortiAnalyzer versions 7.4.0 through 7.4.2
FortiAnalyzer versions prior to 7.2.5
FortiManager versions 7.4.0 through 7.4.2
FortiManager versions prior to 7.2.5
FortiAnalyzer-BigData versions 7.4.0
FortiAnalyzer-BigData versions prior to 7.2.7
Description:
The issue is related to improper neutralization of special elements used in an SQL Command, which can lead to SQL Injection. This allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.
Recommendations:
For FortiAnalyzer versions 7.4.0 through 7.4.2, update to a version after 7.4.2 or apply the necessary patch.
For FortiAnalyzer versions prior to 7.2.5, update to version 7.2.5 or later.
For FortiManager versions 7.4.0 through 7.4.2, update to a version after 7.4.2 or apply the necessary patch.
For FortiManager versions prior to 7.2.5, update to version 7.2.5 or later.
For FortiAnalyzer-BigData versions 7.4.0, update to a version after 7.4.0 or apply the necessary patch.
For FortiAnalyzer-BigData versions prior to 7.2.7, update to version 7.2.7 or later.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fortianalyzer
Fortianalyzer-Bigdata
Fortimanager