CyberCVE

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.

Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.006
49.0th percentile
Discovered by
Vendor
Vendor advisory field
Published
Oct 8, 2024
Assigned by fortinet

Description

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests.

Weakness: CWE-134

Affected products

Vendor Product Category Matched by
Fortinet FortiAnalyzer SIEM & Log Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiAnalyzer

Credit

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.

Vendor remediation

Please upgrade to FortiAnalyzer Cloud version 7.4.4 or above Please upgrade to FortiAnalyzer Cloud version 7.2.7 or above Please upgrade to FortiAnalyzer version 7.6.0 or above Please upgrade to FortiAnalyzer version 7.4.4 or above Please upgrade to FortiAnalyzer version 7.2.6 or above

References

Something wrong here?