CVE-2024-35274
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and
Description
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read write administrative privileges to create non-arbitrary files on a chosen directory via crafted CLI requests.
Weakness: CWE-23
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiAnalyzer Check your version | SIEM & Log Management | cna-assigner |
| Fortinet | FortiManager Check your version | Network & Security Management | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiAnalyzer
- Fortinet · FortiManager
Credit
Internally discovered and reported by Theo Leleu of Fortinet Product Security team.
Vendor remediation
Please upgrade to FortiAnalyzer-BigData version 7.4.1 or above Please upgrade to FortiAnalyzer version 7.4.3 or above Please upgrade to FortiManager version 7.4.3 or above