← Back

CVE-2024-33501

nvd nist
Published: Mar 11, 2025Modified: Jul 24, 2025

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: NVD

Description

Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.

Affected (7)

Fortinet
3 products
Fortianalyzer
Fortianalyzer Big Data
Fortimanager
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortianalyzer
From 6.4.0 to 7.2.6
Fortianalyzer
From 7.4.0 to 7.4.3
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortianalyzer Big Data
From 6.4.5 to 7.2.8
Fortianalyzer Big Data
Version 7.4.0
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortimanager
From 6.0.10 to 6.0.12
Fortimanager
From 6.2.8 to 7.2.6
Fortimanager
From 7.4.0 to 7.4.3

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.