CVE-2024-35274
2.3
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Exploitability: 0.8 / Impact: 1.4
Source: NVD
Description
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read write administrative privileges to create non-arbitrary files on a chosen directory via crafted CLI requests.
Affected (3)
Products: Fortinet: Fortianalyzer, Fortianalyzer Big Data, Fortimanager
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 6.2.0 to 7.4.3 | |
| From 6.2.1 to 7.4.1 | |
| From 6.2.0 to 7.4.3 |
Related CWEs
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
References (1)
Timeline
No history available yet.