CVE-2024-32117

Published: Nov 12, 2024Modified: Jun 17, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and below 7.2.5 & FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker to read arbitrary files from the underlying system via crafted HTTP or HTTPs requests.

Affected (6)

Products: Fortinet: Fortianalyzer, Fortianalyzer Big Data, Fortimanager

Fortinet

3 products

Fortianalyzer

Fortianalyzer Big Data

Fortimanager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	6.2.0 ≤ version < 7.2.6
Fortinet Fortianalyzer	7.4.0 ≤ version < 7.4.3
Fortinet Fortianalyzer Big Data	6.2.1 ≤ version < 7.2.8
Fortinet Fortianalyzer Big Data	Version 7.4.0
Fortinet Fortimanager	6.2.0 ≤ version < 7.2.6
Fortinet Fortimanager	7.4.0 ≤ version < 7.4.3

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-115

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.