Main Vulnerability Database Vulnerabilities #VU105614

SQL injection in Fortinet, Inc products - CVE-2024-33501

Published: March 11, 2025

Vulnerability identifier: #VU105614

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-33501

CWE-ID: CWE-89

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in CLI. A local user can execute arbitrary SQL commands within the application database.

Affected software

FortiManager
FortiAnalyzer
FortiAnalyzer-BigData

How to mitigate CVE-2024-33501

Install update from vendor's website.

FortiManager - addressed in versions 7.2.6, 7.4.3
FortiAnalyzer - addressed in versions 7.2.6, 7.4.3
FortiAnalyzer-BigData - addressed in versions 7.2.8, 7.4.1

External References

https://fortiguard.fortinet.com/psirt/FG-IR-24-130

Related Security Bulletins