The vulnerability of the sdnproxy module of the FortiAnalyzer security monitoring and event analysis tool, as well as the FortiManager device management software, allows a perpetrator to execute arbitrary code and gain increased privileges.

🗓️ 24 Jan 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

SDN proxy flaw in FortiAnalyzer and FortiManager enables code execution and privilege escalation via crafted HTTP requests.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-35275	14 Jan 202514:16	–	circl
CNNVD	Fortinet FortiManager和Fortinet FortiAnalyzer SQL注入漏洞	14 Jan 202500:00	–	cnnvd
CVE	CVE-2024-35275	14 Jan 202514:08	–	cve
Cvelist	CVE-2024-35275	14 Jan 202514:08	–	cvelist
EUVD	EUVD-2024-35558	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS and FortiProxy	15 Jan 202513:25	–	ncsc
NVD	CVE-2024-35275	14 Jan 202514:15	–	nvd
OSV	CVE-2024-35275	14 Jan 202514:15	–	osv
Positive Technologies	PT-2024-10270 · Fortinet · Fortimanager +1	14 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-35275	23 May 202507:12	–	redhatcve

Vulners

Node

fortinet fortimanagerRange7.4.0–7.4.3

OR

fortinet fortianalyzerRange7.4.0–7.4.4

OR

fortinet fortianalyzer_cloudRange7.4.1–7.4.3

OR

fortinet fortimanager_cloudRange7.4.1–7.4.3

Source	Link
fortiguard	www.fortiguard.fortinet.com/psirt/FG-IR-24-091
vuldb	www.vuldb.com/
web	www.web.nvd.nist.gov/view/vuln/detail
fortiguard	www.fortiguard.com/psirt/FG-IR-24-091

24 Jan 2025 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 36.6

CVSS 27.1

EPSS0.0079

sdn proxy forti analyzer forti manager code execution privilege escalation crafted http requests sql handling