CVE-2024-33501

Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attackerto execute unauthorized code or commands via specifically crafted CLI requests.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.2 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
fortinetCNA
4 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:X
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
fortinetfortianalyzer
6.4.0 ≤
𝑥
< 7.2.6
fortinetfortianalyzer
7.4.0 ≤
𝑥
< 7.4.3
fortinetfortianalyzer_big_data
6.4.5 ≤
𝑥
< 7.2.8
fortinetfortianalyzer_big_data
7.4.0
fortinetfortimanager
6.0.10 ≤
𝑥
≤ 6.0.12
fortinetfortimanager
6.2.8 ≤
𝑥
< 7.2.6
fortinetfortimanager
7.4.0 ≤
𝑥
< 7.4.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://fortiguard.fortinet.com/psirt/FG-IR-24-130