Fortinet FortiManager/Analyzer Path Traversal Vulnerability (CVE-2024-32117)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Arbitrary file read in administrative interface 2. Vulnerability Description: A path traversal (CWE-22) vulnerability exists in FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData. This vulnerability allows privileged attackers to read arbitrary files on the system by crafting malicious HTTP or HTTPS requests. 3. Affected Versions: - FortiAnalyzer 7.4: 7.4.0 to 7.4.2 - FortiAnalyzer 7.2: 7.2.0 to 7.2.5 - FortiAnalyzer 7.0: All versions - FortiAnalyzer 6.4: All versions - FortiAnalyzer 6.2: All versions - FortiAnalyzer-BigData 7.4: 7.4.0 - FortiAnalyzer-BigData 7.2: 7.2.0 to 7.2.7 - FortiAnalyzer-BigData 7.0: All versions - FortiAnalyzer-BigData 6.4: All versions - FortiAnalyzer-BigData 6.2: All versions - FortiManager 7.4: 7.4.0 to 7.4.2 - FortiManager 7.2: 7.2.0 to 7.2.5 - FortiManager 7.0: All versions - FortiManager 6.4: All versions - FortiManager 6.2: All versions 4. Solution: Upgrade to version 7.4.3 or later, or migrate to a fixed version. 5. Vulnerability ID: FG-IR-24-115 6. Release Date: November 12, 2024 7. Component: GUI 8. Severity: Medium 9. CVSSv3 Score: 4.7 10. Impact: Information disclosure 11. CVE ID: CVE-2024-32117 12. CVRF: Download link This information helps users understand the vulnerability details, affected versions, remediation steps, and related security measures.

Goal Reached Thanks to every supporter — we hit 100%!

Fortinet FortiManager/Analyzer Path Traversal Vulnerability (CVE-2024-32117)