CVE-2024-33502

CVE-2024-33502 is a path traversal vulnerability (CWE-22) affecting Fortinet FortiManager and FortiAnalyzer in versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and 6.0.0 through 6.0.12. It stems from improper limitation of a pathname to a restricted directory, enabling attackers to execute unauthorized code or commands through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), indicating medium severity with high integrity and availability impacts but no confidentiality loss.

Exploitation requires high privileges (PR:H), allowing a privileged remote attacker with network access to craft malicious requests that traverse directory restrictions and achieve remote code execution. The low attack complexity and lack of user interaction make it feasible for authenticated administrative users to abuse, potentially leading to full system compromise, command injection, or persistence within the affected FortiManager or FortiAnalyzer instances.

Fortinet's advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-143 provides details on patches and mitigation recommendations for this issue, published on 2025-01-14. Security practitioners should consult the advisory for version-specific upgrades and any interim workarounds.