CVE-2024-35275
Published: 14 January 2025
Description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
Security Summary
CVE-2024-35275 is an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements used in an SQL command. It affects Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2 and FortiManager versions 7.4.0 through 7.4.2. The flaw allows attackers to achieve privilege escalation via specially crafted HTTP requests.
Exploitation is possible over the network (AV:N) by an attacker with high privileges (PR:H) on the affected system, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful attacks result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U), earning a CVSS v3.1 base score of 6.6.
Fortinet's PSIRT advisory FG-IR-24-091, available at https://fortiguard.fortinet.com/psirt/FG-IR-24-091, provides details on mitigation and patches for this vulnerability.
Details
- CWE(s)