CVE-2024-40584

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 6.2.2 through 6.2.13 Fortinet FortiAnalyzer versions 6.4.0 through 6.4.15 Fortinet FortiAnalyzer versions 7.0.0 through 7.0.13 Fortinet FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3 Fortinet FortiAnalyzer BigData version 6.2.5 Fortinet FortiAnalyzer BigData versions 6.4.5 through 6.4.7 Fortinet FortiAnalyzer BigData versions 7.0.1 through 7.0.6 Fortinet FortiAnalyzer BigData versions 7.2.0 through 7.2.7 Fortinet FortiAnalyzer BigData version 7.4.0 Fortinet FortiAnalyzer Cloud versions 6.4.1 through 6.4.7 Fortinet FortiAnalyzer Cloud versions 7.0.1 through 7.0.13 Fortinet FortiAnalyzer Cloud versions 7.2.1 through 7.2.5 Fortinet FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 Fortinet FortiManager versions 6.2.2 through 6.2.13 Fortinet FortiManager versions 6.4.0 through 6.4.15 Fortinet FortiManager versions 7.0.0 through 7.0.13 Fortinet FortiManager versions 7.2.0 through 7.2.5 Fortinet FortiManager versions 7.4.0 through 7.4.3 Fortinet FortiManager Cloud versions 6.4.1 through 6.4.7 Fortinet FortiManager Cloud versions 7.0.1 through 7.0.13 Fortinet FortiManager Cloud versions 7.2.1 through 7.2.5 Fortinet FortiManager Cloud versions 7.4.1 through 7.4.3

Description: The vulnerability exists due to the improper neutralization of special elements used in an OS command. This allows an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTPS or HTTP requests.

Recommendations: As a temporary workaround, consider disabling the vulnerable GUI components until a patch is available. Restrict access to the vulnerable FortiAnalyzer and FortiManager modules to minimize the risk of exploitation. Avoid using the vulnerable FortiAnalyzer BigData and FortiManager Cloud versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.