PT-2025-1319 · Fortinet · Fortianalyzer+1

Published 2025-01-14 · Updated 2025-01-21 · CVE-2024-33502

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12 Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12 Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14 Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12 Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', which allows an attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests. This can be achieved by sending a specially formed HTTP request. The vulnerability is associated with errors in processing the relative path to a directory.

Recommendations For Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable directory to minimize the risk of exploitation.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2025-01025

CVE-2024-33502

Affected Products

Fortianalyzer

Fortimanager

References · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-24-143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33502 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33502 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01025 · Security Note
• https://twitter.com/CVEnew/status/1879174632328339463 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cvenotify/108138 · Telegram Post