CVE-2024-45330

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 7.2.2 through 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3

Description: The issue is related to the use of an externally-controlled format string in the FortiAnalyzer event tracking and analysis tool. This could allow an attacker to escalate privileges via specially crafted requests, potentially enabling the execution of arbitrary code or commands.

Recommendations: For Fortinet FortiAnalyzer versions 7.2.2 through 7.2.5, update to a version outside of this range to mitigate the risk. For Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the fazsvcd daemon to minimize the risk of exploitation.