Description
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiPortal | 6.0.0 – ≤ 6.0.14, 5.3.0 – ≤ 5.3.8 | — |
| Fortinet | FortiAnalyzer-BigData | 7.2.0 – ≤ 7.2.5, 7.0.1 – ≤ 7.0.6, 6.4.5 – ≤ 6.4.7, 6.2.5 | — |
| Fortinet | FortiAnalyzer | 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.3, 7.0.0 – ≤ 7.0.9, 6.4.0 – ≤ 6.4.15, 6.2.0 – ≤ 6.2.13 | — |
| Fortinet | FortiManager | 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.3, 7.0.0 – ≤ 7.0.9, 6.4.0 – ≤ 6.4.15, 6.2.0 – ≤ 6.2.13 | — |
Advisories 1
- WID-SEC-2024-0600 Fortinet FortiAnalyzer und Fortinet FortiManager: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Mar 12, 2024