CyberCVE

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.

Severity
Medium 6.8
CVSS 3.1
Remote, needs privileges or user interaction what this means
Exploited
Not listed
EPSS
0.006
48.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Oct 8, 2024
Assigned by fortinet

Description

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.

Weakness: CWE-134

Affected products

Vendor Product Category Matched by
Fortinet FortiAnalyzer Check your version SIEM & Log Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiAnalyzer

Credit

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.

Vendor remediation

Please upgrade to FortiAnalyzer Cloud version 7.4.4 or above Please upgrade to FortiAnalyzer Cloud version 7.2.7 or above Please upgrade to FortiAnalyzer version 7.6.0 or above Please upgrade to FortiAnalyzer version 7.4.4 or above Please upgrade to FortiAnalyzer version 7.2.6 or above

References

Something wrong here?