CVE-2024-36512

HIGH

Fortinet FortiManager/FortiAnalyzer <7.4.3/<7.2.5/<7.0.12/<6.2.13 -...

Title source: llm

Description

An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4.3 and 7.2.0 through 7.2.5 and 7.0.2 through 7.0.12 and 6.2.10 through 6.2.13 allows attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.fortinet.com/psirt/FG-IR-24-152

Scores

CVSS v3 7.2

EPSS 0.0066

EPSS Percentile 71.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-22

Status published

Products (2)

fortinet/fortianalyzer 6.2.10 - 7.0.13

fortinet/fortimanager 6.2.10 - 7.0.13

Published Jan 14, 2025

Tracked Since Feb 18, 2026