CVE-2024-45324

11.03.2025, 15:15

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.2 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
fortinet	CNA	7 HIGH	NETWORK	LOW	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 13%

Vendor	Product	Version
fortinet	fortios	6.2.0 ≤ 𝑥 < 6.2.17
fortinet	fortios	6.4.0 ≤ 𝑥 < 6.4.16
fortinet	fortios	7.0.0 ≤ 𝑥 < 7.0.16
fortinet	fortios	7.2.0 ≤ 𝑥 < 7.2.10
fortinet	fortios	7.4.0 ≤ 𝑥 < 7.4.5
fortinet	fortipam	1.0.0 ≤ 𝑥 ≤ 1.3.1
fortinet	fortipam	1.4.0 ≤ 𝑥 < 1.4.3
fortinet	fortiproxy	7.0.0 ≤ 𝑥 < 7.0.20
fortinet	fortiproxy	7.2.0 ≤ 𝑥 < 7.2.13
fortinet	fortiproxy	7.4.0 ≤ 𝑥 < 7.4.7
fortinet	fortiproxy	7.6.0
fortinet	fortiweb	7.0.0 ≤ 𝑥 < 7.0.11
fortinet	fortiweb	7.2.0 ≤ 𝑥 < 7.2.11
fortinet	fortiweb	7.4.0 ≤ 𝑥 < 7.4.6
fortinet	fortiweb	7.6.0
fortinet	fortisra	1.4.0 ≤ 𝑥 < 1.4.3

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-134 - Use of Externally-Controlled Format String
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-325