CVE-2024-33501: Authenticated SQLI on CLI
Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager & FortiAnalyzer-BigData may allow a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.
Other sources
Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33501?
CVE-2024-33501 has been classified as a high severity SQL injection vulnerability that could allow unauthorized command execution.
How do I fix CVE-2024-33501?
To remediate CVE-2024-33501, upgrade FortiAnalyzer or FortiManager to versions 7.4.3 or later, or 7.2.6 or later, depending on your product.
Which versions of Fortinet products are affected by CVE-2024-33501?
The affected products include FortiAnalyzer, FortiManager, and FortiAnalyzer-BigData versions prior to 7.4.3 and 7.2.6.
Can an attacker exploit CVE-2024-33501 remotely?
Yes, a privileged attacker can exploit CVE-2024-33501 remotely via specially crafted CLI requests.
What types of products are impacted by CVE-2024-33501?
CVE-2024-33501 impacts Fortinet products such as FortiAnalyzer, FortiManager, and FortiAnalyzer-BigData.