Fortinet FortiAnalyzer/Manager Path Traversal Vulnerability Leading to File Creation

Key Information Vulnerability Description Title: Path traversal vulnerability leading to file creation Description: A path traversal vulnerability allows an attacker with read/write management privileges to create non-arbitrary files in restricted directories via crafted CLI requests. Affected Ranges Affected Versions: - FortiAnalyzer 7.4: 7.4.0 to 7.4.2 - FortiAnalyzer 7.2: All versions - FortiAnalyzer 7.0: All versions - FortiAnalyzer 6.4: All versions - FortiAnalyzer 6.2: All versions - FortiAnalyzer-BigData 7.4: 7.4.0 - FortiAnalyzer-BigData 7.2: All versions - FortiAnalyzer-BigData 7.0: All versions - FortiAnalyzer-BigData 6.4: All versions - FortiAnalyzer-BigData 6.2: All versions - FortiManager 7.4: 7.4.0 to 7.4.2 - FortiManager 7.2: All versions - FortiManager 7.0: All versions - FortiManager 6.4: All versions - FortiManager 6.2: All versions Solution Upgrade to: - FortiAnalyzer 7.4: 7.4.3 or later - FortiAnalyzer 7.2: All versions in 7.2 series - FortiAnalyzer 7.0: All versions in 7.0 series - FortiAnalyzer 6.4: All versions in 6.4 series - FortiAnalyzer 6.2: All versions in 6.2 series - FortiAnalyzer-BigData 7.4: 7.4.1 or later - FortiAnalyzer-BigData 7.2: All versions in 7.2 series - FortiAnalyzer-BigData 7.0: All versions in 7.0 series - FortiAnalyzer-BigData 6.4: All versions in 6.4 series - FortiAnalyzer-BigData 6.2: All versions in 6.2 series - FortiManager 7.4: 7.4.3 or later - FortiManager 7.2: All versions in 7.2 series - FortiManager 7.0: All versions in 7.0 series - FortiManager 6.4: All versions in 6.4 series - FortiManager 6.2: All versions in 6.2 series Identification and Reporting Discoverer: Theo Leleu, Fortinet Product Security Team Report Date: November 12, 2024 Security Rating CVSSv3 Score: 2.2 Impact: Improper Access Control Other Language: English Download: Download links for related files Summary This vulnerability enables attackers with specific privileges to create non-arbitrary files in restricted directories by crafting malicious CLI requests. A wide range of versions are affected, including FortiAnalyzer, FortiManager, and FortiAnalyzer-BigData series. Affected users are advised to upgrade to the corresponding fixed versions as soon as possible to mitigate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Fortinet FortiAnalyzer/Manager Path Traversal Vulnerability Leading to File Creation