CVE-2024-36512 | FortiManager - FortiAnalyzer Operational Intel

Executive Risk Summary

"A path traversal vulnerability in Fortinet FortiManager and FortiAnalyzer allows attackers to execute unauthorized code or commands via crafted HTTP or HTTPS requests, potentially leading to system compromise. Affected versions include 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.2 through 7.0.12, and 6.2.10 through 6.2.13."

Operational Audit Arsenal

Target Type Firmware Image

Target Asset FortiManager Firmware

Standard Path Global Firmware

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

FortiManager and FortiAnalyzer systems are vulnerable to a path traversal attack, requiring immediate patching to prevent potential system compromise.

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-24-152

Scope of Impact

Fortinet FortimanagerFortinet Fortianalyzer

Original NVD Description

"An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4.3 and 7.2.0 through 7.2.5 and 7.0.2 through 7.0.12 and 6.2.10 through 6.2.13 allows attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-34992 CVSS 10

FortiGate - API

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.