CVE-2024-36508: Multiple arbitrary file deletion in the CLI
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer CLI may allow any authenticated admin user with diagnose privileges to delete any file on the system.
Other sources
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 CLI allows an authenticated admin user with diagnose privileges to delete files on the system.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36508?
CVE-2024-36508 is classified as a medium severity vulnerability due to its potential impact on system confidentiality and integrity.
How do I fix CVE-2024-36508?
To fix CVE-2024-36508, upgrade FortiManager and FortiAnalyzer to versions 7.4.3 or later and 7.2.6 or later.
What types of systems are affected by CVE-2024-36508?
CVE-2024-36508 affects Fortinet FortiManager and FortiAnalyzer versions 7.4.0 through 7.4.2 and earlier than 7.2.5.
Who can exploit CVE-2024-36508?
An authenticated admin user with appropriate permissions can exploit CVE-2024-36508 due to improper path limitations.
What is the nature of the vulnerability in CVE-2024-36508?
CVE-2024-36508 is a path traversal vulnerability that allows attackers to access restricted directories on the affected systems.