← Back

CVE-2024-33508

nvd nist
Published: Sep 10, 2024Modified: Sep 20, 2024

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability: 3.9 / Impact: 3.4
Source: NVD

Description

An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted requests.

Affected (2)

Fortinet
1 product
Forticlient Enterprise Management Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Forticlient Enterprise Management Server
From 7.0.0 to 7.0.13
Forticlient Enterprise Management Server
From 7.2.0 to 7.2.5

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.