DeutschShown in its original language — a full translation is planned for a future version.
Fortinet FortiAnalyzer: Mehrere Schwachstellen
view advisory published 2024-11-12
Ein Angreifer kann mehrere Schwachstellen in Fortinet FortiAnalyzer und Fortinet FortiManager ausnutzen, um vertrauliche Informationen preiszugeben, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen und Dateien zu manipulieren.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-35274US | low2.3 | — | ||
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versi… | ||||
| CVE-2024-33505US | high7.3 | — | ||
A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager version 7.4.0 thro… | ||||
| CVE-2024-32118US | medium6.7 | — | ||
Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiManager version 7.4.0 through 7.4.2 an… | ||||
| CVE-2024-32117US | medium4.9 | — | ||
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, Forti… | ||||
| CVE-2024-32116US | medium6.0 | — | ||
Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and befor… | ||||
| CVE-2024-31496US | medium6.7 | — | ||
A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.… | ||||
| CVE-2024-23666US | high8.8 | Exploit | ||
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData
at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7… | ||||
| CVE-2023-44255US | medium4.1 | — | ||
An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2024-3447 - CSAF Versionself
- WID-SEC-2024-3447 - Portal Versionself
- FortiGuard PSIRT Advisory FG-IR-23-267 vom 2024-11-12external
- FortiGuard PSIRT Advisory FG-IR-23-396 vom 2024-11-12external
- FortiGuard PSIRT Advisory FG-IR-24-098 vom 2024-11-12external
- FortiGuard PSIRT Advisory FG-IR-24-099 vom 2024-11-12external
- FortiGuard PSIRT Advisory FG-IR-24-115 vom 2024-11-12external
- FortiGuard PSIRT Advisory FG-IR-24-116 vom 2024-11-12external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan