CVE-2024-33502

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12 Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12 Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14 Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12 Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal', which allows an attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests. This can be achieved by sending a specially formed HTTP request. The vulnerability is associated with errors in processing the relative path to a directory.

Recommendations For Fortinet FortiManager, FortiAnalyzer versions 6.0.0 through 6.0.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 6.2.0 through 6.2.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 6.4.0 through 6.4.14, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.0.0 through 7.0.12, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.2.0 through 7.2.5, update to a version outside of this range to resolve the issue. For Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable directory to minimize the risk of exploitation.