CVE-2024-33501

Description

Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.

Reserved 2024-04-23 | Published 2025-03-11 | Updated 2025-03-11 | Assigner fortinet

Problem types

Execute unauthorized code or commands

Product status

Default status
unaffected

7.4.0
affected

7.2.0
affected

7.0.0
affected

6.4.4
affected

6.2.8
affected

6.0.10
affected

References

fortiguard.fortinet.com/psirt/FG-IR-24-130

cve.org (CVE-2024-33501)

nvd.nist.gov (CVE-2024-33501)

Download JSON