CVE-2024-33502

MEDIUM

FortiAnalyzer/FortiManager Path Traversal via Crafted HTTP/HTTPS Requests

Title source: llm

Description

An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 allows attacker to execute unauthorized code or commands via crafted HTTP or HTTPs requests.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.fortinet.com/psirt/FG-IR-24-143

Scores

CVSS v3 6.5

EPSS 0.0067

EPSS Percentile 71.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-22

Status published

Products (2)

fortinet/fortianalyzer 6.0.0 - 7.2.6

fortinet/fortimanager 6.0.0 - 7.2.6

Published Jan 14, 2025

Tracked Since Feb 18, 2026