CVE-2024-33502
Published: 14 January 2025
Summary
CVE-2024-33502 is a medium-severity Path Traversal (CWE-22) vulnerability in Fortinet Fortianalyzer. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 28.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal by requiring validation of crafted HTTP/HTTPS pathname inputs to prevent access to restricted directories.
Enforces approved access authorizations to information and system resources, preventing unauthorized directory traversal and code execution.
Requires identification, reporting, and correction of flaws like this path traversal vulnerability through timely patching as advised by Fortinet.
NVD Description
An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12…
more
allows attacker to execute unauthorized code or commands via crafted HTTP or HTTPs requests.
Deeper analysisAI
CVE-2024-33502 is a path traversal vulnerability (CWE-22) affecting Fortinet FortiManager and FortiAnalyzer in versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and 6.0.0 through 6.0.12. It stems from improper limitation of a pathname to a restricted directory, enabling attackers to execute unauthorized code or commands through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), indicating medium severity with high integrity and availability impacts but no confidentiality loss.
Exploitation requires high privileges (PR:H), allowing a privileged remote attacker with network access to craft malicious requests that traverse directory restrictions and achieve remote code execution. The low attack complexity and lack of user interaction make it feasible for authenticated administrative users to abuse, potentially leading to full system compromise, command injection, or persistence within the affected FortiManager or FortiAnalyzer instances.
Fortinet's advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-143 provides details on patches and mitigation recommendations for this issue, published on 2025-01-14. Security practitioners should consult the advisory for version-specific upgrades and any interim workarounds.
Details
- CWE(s)