Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiManager | 7.4.0 – ≤ 7.4.2 | — |
| Fortinet | FortiAnalyzer | 7.4.0 – ≤ 7.4.3 | — |
Advisories 2
- NCSC-2025-0018 Kwetsbaarheden verholpen in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS en FortiProxy NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2025-0096 Fortinet FortiAnalyzer und FortiManager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 14, 2025