CVE-2024-33503

Published: Jan 14, 2025Modified: Jan 31, 2025

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A improper privilege management in Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to escalation of privilege via specific shell commands

Affected (8)

Products: Fortinet: Fortianalyzer, Fortianalyzer Cloud, Fortimanager, Fortimanager Cloud

4 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.4.0 to 7.2.6
Fortinet Fortianalyzer	From 7.4.0 to 7.4.4
Fortinet Fortianalyzer Cloud	From 6.4.1 to 7.2.7
Fortinet Fortianalyzer Cloud	From 7.4.1 to 7.4.3
Fortinet Fortimanager	From 6.4.0 to 7.2.6
Fortinet Fortimanager	From 7.4.0 to 7.4.4
Fortinet Fortimanager Cloud	From 7.0.1 to 7.2.7
Fortinet Fortimanager Cloud	From 7.4.1 to 7.4.4

Related CWEs

CWE-266

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-127

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.