Cyber Resilience

CVE-2024-52962

Medium

Published: 08 April 2025

Published
08 April 2025
Modified
23 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0035 58.1th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-52962 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Fortinet Fortimanager. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 41.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below, version 7.0.13 and below and FortiManager version 7.6.1 and below, version 7.4.5 and below, version 7.2.8 and below,…

more

version 7.0.12 and below may allow an unauthenticated remote attacker to pollute the logs via crafted login requests.

CWE(s)
CWE-117

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

fortinet
fortimanager
7.0.0 — 7.0.14 · 7.2.0 — 7.2.9 · 7.4.0 — 7.4.6
fortinet
fortianalyzer
7.0.0 — 7.0.14 · 7.2.0 — 7.2.9 · 7.4.0 — 7.4.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References