CVE-2024-33503: Multiple privilege escalation

Published Jan 14, 2025

Updated

A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands

Other sources

An improper privilege management vulnerability [CWE 269] in FortiManager and FortiAnalyzer may allow a local attacker to escalate their privileges by abusing incorrect filesystem permissions

— FortiGuard

Affected Software

23 affected componentsFixes available

Fortinet FortiAnalyzer>=6.4.0<7.2.6

Fortinet FortiAnalyzer>=7.4.0<7.4.4

Fortinet FortiAnalyzer Cloud>=6.4.1<7.2.7

Fortinet FortiAnalyzer Cloud>=7.4.1<7.4.3

Fortinet FortiManager>=6.4.0<7.2.6

Fortinet FortiManager>=7.4.0<7.4.4

Fortinet FortiManager Cloud>=7.0.1<7.2.7

Fortinet FortiManager Cloud>=7.4.1<7.4.4

Fortinet FortiAnalyzer>=7.4.0<=7.4.3

Fortinet FortiAnalyzer>=7.2.0<=7.2.5

Fortinet FortiAnalyzer>=7.0

Fortinet FortiAnalyzer>=6.4

Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.2

Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.6

Fortinet FortiAnalyzer Cloud>=7.0

Fortinet FortiAnalyzer Cloud>=6.4

Fortinet FortiManager Cloud>=7.4.1<=7.4.3

Fortinet FortiManager Cloud>=7.2.1<=7.2.5

Fortinet FortiManager Cloud>=7.0

Fortinet FortiManager>=7.4.0<=7.4.3

Fortinet FortiManager>=7.2.0<=7.2.5

Fortinet FortiManager>=7.0

Fortinet FortiManager>=6.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.2.7
Upgrade
Upgrade FortiAnalyzer Cloud to a version that resolves this vulnerability.
Fixed in 7.4.3
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.2.6
Upgrade
Upgrade FortiAnalyzer to a version that resolves this vulnerability.
Fixed in 7.4.4
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.2.7
Upgrade
Upgrade FortiManager Cloud to a version that resolves this vulnerability.
Fixed in 7.4.4
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.2.6
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.4.4
Upgrade
Upgrade FortiManager to a version that resolves this vulnerability.
Fixed in 7.6.0

Event History

Jan 14, 2025

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·02:09 PM

Data Sourced

via MITRE·02:09 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-33503?

CVE-2024-33503 has been classified with a high severity due to improper privilege management.

How do I fix CVE-2024-33503?

To mitigate CVE-2024-33503, upgrade to FortiManager version 7.4.4 or later, FortiAnalyzer version 7.4.4 or later, and their cloud counterparts as specified.

Which versions are affected by CVE-2024-33503?

CVE-2024-33503 affects Fortinet FortiManager versions 7.4.0 to 7.4.3, and various earlier versions of FortiAnalyzer.

Is there a workaround for CVE-2024-33503?

There is no confirmed workaround for CVE-2024-33503; the recommended solution is to upgrade to the patched versions.

Who is impacted by CVE-2024-33503?

Organizations using affected versions of Fortinet FortiManager and FortiAnalyzer platforms are vulnerable to CVE-2024-33503.