CVE-2024-35273
First published: Tue Jan 14 2025(Updated: )
A out-of-bounds write in Fortinet FortiManager version 7.4.0 through 7.4.2, FortiAnalyzer version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiManager | >=7.4.0<=7.4.2 | |
| Fortinet FortiAnalyzer | >=7.4.0<=7.4.2 | |
| Fortinet FortiAnalyzer | >=7.4.0<7.4.4 | |
| Fortinet FortiAnalyzer Cloud | >=7.4.1<7.4.3 | |
| Fortinet FortiManager | >=7.4.0<7.4.3 | |
| Fortinet FortiManager Cloud | >=7.4.1<7.4.3 |
Remedy
Please upgrade to FortiAnalyzer Cloud version 7.4.3 or above Please upgrade to FortiOS version 7.6.0 or above Please upgrade to FortiSwitchManager version 7.2.4 or above Please upgrade to FortiProxy version 7.4.5 or above Please upgrade to FortiPAM version 1.3.0 or above Please upgrade to FortiADC version 7.6.0 or above Please upgrade to FortiAuthenticator version 7.0.0 or above Please upgrade to FortiAnalyzer version 7.6.0 or above Please upgrade to FortiAnalyzer version 7.4.4 or above Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager Cloud version 7.4.3 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-35273?
CVE-2024-35273 is classified as a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-35273?
To mitigate CVE-2024-35273, update Fortinet FortiManager to version 7.4.3 or later and FortiAnalyzer to version 7.4.3 or later.
What are the affected versions listed for CVE-2024-35273?
CVE-2024-35273 affects Fortinet FortiManager versions 7.4.0 to 7.4.2 and FortiAnalyzer versions 7.4.0 to 7.4.2.
What type of vulnerability is CVE-2024-35273?
CVE-2024-35273 is an out-of-bounds write vulnerability that allows an attacker to escalate privileges.
Can CVE-2024-35273 be exploited remotely?
Yes, CVE-2024-35273 can be exploited via specially crafted HTTP requests, making it a remote exploitation risk.
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-api
- source/NVD
- vendor/fortinet
- canonical/fortinet fortimanager
- canonical/fortinet fortianalyzer
- version/fortinet fortianalyzer/7.4.0
- canonical/fortinet fortianalyzer cloud
- version/fortinet fortianalyzer cloud/7.4.1
- version/fortinet fortimanager/7.4.0
- canonical/fortinet fortimanager cloud
- version/fortinet fortimanager cloud/7.4.1