Medium WID-SEC-2024-3447 8 CVEs

Fortinet FortiAnalyzer: Mehrere Schwachstellen

Published Nov 12, 2024 · Updated Nov 12, 2024 · de-DE

Vendor: Fortinet Product: FortiAnalyzer Product: FortiManager

Summary

Ein Angreifer kann mehrere Schwachstellen in Fortinet FortiAnalyzer und Fortinet FortiManager ausnutzen, um vertrauliche Informationen preiszugeben, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen und Dateien zu manipulieren.

Product

FortiAnalyzer ist eine Plattform zur Protokollverwaltung, Analyse und Berichterstellung.
FortiManager Security Management Appliances ermöglicht die Verwaltung von Fortinet Network Security Geräten.

Vulnerabilities 8

High 7.1

CVE-2024-23666 Public exploit

A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 th…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Medium 6.3

CVE-2024-31496

A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Medium 6.3

CVE-2024-32118

Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CW…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Medium 5.3

CVE-2024-33505

A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through …

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Medium 4.8

CVE-2024-32116

Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and befo…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Medium 4.7

CVE-2024-32117

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet Fo…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Low 3.9

CVE-2023-44255

An exposure of sensitive information to an unauthorized actor [CWE-200] in Fortinet FortiManager before 7.4.2, FortiAna…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024
Low 2.2

CVE-2024-35274

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet Fo…

Fortinet FortiManager FortiAnalyzer Network devices

Nov 12, 2024

Revision history

2024-11-12 #1
Initiale Fassung

References

FortiGuard PSIRT Advisory FG-IR-23-267 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-23-267
FortiGuard PSIRT Advisory FG-IR-23-396 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-23-396
FortiGuard PSIRT Advisory FG-IR-24-098 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-098
FortiGuard PSIRT Advisory FG-IR-24-099 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-099
FortiGuard PSIRT Advisory FG-IR-24-115 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-115
FortiGuard PSIRT Advisory FG-IR-24-116 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-116
FortiGuard PSIRT Advisory FG-IR-24-125 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-125
FortiGuard PSIRT Advisory FG-IR-24-179 vom 2024-11-12
https://www.fortiguard.com/psirt/FG-IR-24-179