CVE-2021-24022: Buffer Overflow
First published: Tue Jul 20 2021(Updated: )
A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | >=6.0.0<6.2.8 | |
| Fortinet FortiAnalyzer | >=6.4.0<6.4.6 | |
| Fortinet FortiManager | >=6.0.0<6.2.8 | |
| Fortinet FortiManager | >=6.4.0<6.4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-24022?
The severity of CVE-2021-24022 is medium with a severity value of 4.4.
How does CVE-2021-24022 affect FortiAnalyzer and FortiManager?
CVE-2021-24022 affects FortiAnalyzer CLI version 6.4.5 and below, 6.2.7 and below, and 6.0.x, as well as FortiManager CLI version 6.4.5 and below, 6.2.7 and below, and 6.0.x.
What is the vulnerability description of CVE-2021-24022?
CVE-2021-24022 is a buffer overflow vulnerability that may allow an authenticated, local attacker to perform a Denial of Service attack by running a specific command with a large input.
How can an attacker exploit CVE-2021-24022?
An attacker can exploit CVE-2021-24022 by running the 'diagnose system geoip-city' command with a large input.
Is there a fix for CVE-2021-24022?
Yes, the fix for CVE-2021-24022 is to upgrade to FortiAnalyzer CLI version 6.4.6 or above, 6.2.8 or above, or 6.0.x or above, and FortiManager CLI version 6.4.6 or above, 6.2.8 or above, or 6.0.x or above.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/fortinet
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/6.0.0
- version/fortinet fortianalyzer/6.4.0
- canonical/fortinet fortimanager
- version/fortinet fortimanager/6.0.0
- version/fortinet fortimanager/6.4.0