CVE-2024-33503

Published: Jan 14, 2025Modified: Jul 8, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands

Affected (8)

Products: Fortinet: Fortianalyzer, Fortianalyzer Cloud, Fortimanager, Fortimanager Cloud

4 products

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.4.0 to 7.2.6
Fortinet Fortianalyzer	From 7.4.0 to 7.4.4
Fortinet Fortianalyzer Cloud	From 6.4.1 to 7.2.7
Fortinet Fortianalyzer Cloud	From 7.4.1 to 7.4.3
Fortinet Fortimanager	From 6.4.0 to 7.2.6
Fortinet Fortimanager	From 7.4.0 to 7.4.4
Fortinet Fortimanager Cloud	From 7.0.1 to 7.2.7
Fortinet Fortimanager Cloud	From 7.4.1 to 7.4.4

Related CWEs

CWE-266

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-127

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.