CVE-2024-33503

HighCVSS 7.8/10Last modified Jul 8, 2026

Description

A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jul 8, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-335047.7A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7 CVE-2024-335057.3A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through CVE-2024-335064.3An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiManager 7.4.2 and below, 7.2.5 and below, 7.0.CVE-2024-335079.1An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 thr CVE-2024-335087.3An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2 CVE-2024-335094.8An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all v CVE-2024-33519.8A vulnerability, which was classified as critical, was found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affec CVE-2024-335104.3An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS vers CVE-2024-335119.8There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execut CVE-2024-335129.8There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated rem CVE-2024-335135.9Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335147.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi