CVE-2024-32123

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12 Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14 Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12 Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12 Fortinet FortiManager, FortiAnalyzer versions 5.6.0 through 5.6.11 Fortinet FortiManager, FortiAnalyzer versions 5.4.0 through 5.4.7 Fortinet FortiManager, FortiAnalyzer versions 5.2.0 through 5.2.10 Fortinet FortiManager, FortiAnalyzer versions 5.0.0 through 5.0.12 Fortinet FortiManager, FortiAnalyzer versions 4.3.4 through 4.3.8

Description: The issue is related to multiple improper neutralization of special elements used in an os command, also known as 'os command injection', in Fortinet FortiManager and FortiAnalyzer. This allows an attacker to execute unauthorized code or commands via crafted CLI requests.

Recommendations: For versions 7.4.0 through 7.4.2, update to a version outside of this range to mitigate the risk. For versions 7.2.0 through 7.2.5, update to a version outside of this range to mitigate the risk. For versions 7.0.0 through 7.0.12, update to a version outside of this range to mitigate the risk. For versions 6.4.0 through 6.4.14, update to a version outside of this range to mitigate the risk. For versions 6.2.0 through 6.2.12, update to a version outside of this range to mitigate the risk. For versions 6.0.0 through 6.0.12, update to a version outside of this range to mitigate the risk. For versions 5.6.0 through 5.6.11, update to a version outside of this range to mitigate the risk. For versions 5.4.0 through 5.4.7, update to a version outside of this range to mitigate the risk. For versions 5.2.0 through 5.2.10, update to a version outside of this range to mitigate the risk. For versions 5.0.0 through 5.0.12, update to a version outside of this range to mitigate the risk. For versions 4.3.4 through 4.3.8, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.