Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-35274: Fortinet FortiAnalyzer, FortiManager: Malicious Files Can Be Created

CVE-2024-35274 · published 1 year ago

Summary

An outdated version of Fortinet's FortiAnalyzer and FortiManager software can allow hackers with high-level access to create unauthorized files on a system. This can lead to unintended consequences, such as data loss or disruption of services. Fortinet recommends upgrading to version 7.4.2 or later to protect against this risk.

What to do

Update fortinet fortianalyzer to version 7.4.3 or later.
Update fortinet fortianalyzer_big_data to version 7.4.1 or later.
Update fortinet fortimanager to version 7.4.3 or later.

Affected software

Vendor	Product	Affected versions
fortinet	fortianalyzer	>= 6.2.0, < 7.4.3 `cpe:2.3:a:fortinet:fortianalyzer::::::::`
fortinet	fortianalyzer_big_data	>= 6.2.1, < 7.4.1 `cpe:2.3:a:fortinet:fortianalyzer_big_data::::::::`
fortinet	fortimanager	>= 6.2.0, < 7.4.3 `cpe:2.3:a:fortinet:fortimanager::::::::`

Original advisory text

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read write administrative privileges to create non-arbitrary files on a chosen directory via crafted CLI requests.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-179 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-23Relative Path Traversal

CWE-22Path Traversal

Timeline

Published12 Nov 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-35274 · NVD

Track software like this

Free during beta