CVE-2024-33510

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability [CWE-74] in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below; FortiSASE version 24.2.b SSL-VPN web user interface may allow a remote unauthenticated attacker to perform phishing attempts via crafted requests.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-358

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.8; >= 7.0.0, <= 7.0.16
Fortinet	FortiProxy	>= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.16

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-033Vendor Advisory

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-335119.8There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execut CVE-2024-335129.8There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated rem CVE-2024-335135.9Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335147.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335157.5Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. Successful exploi CVE-2024-335167.5An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. Suc CVE-2024-335177.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Succe CVE-2024-335185.3An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. Succe CVE-2024-335197.2A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote CVE-2024-33529.8A vulnerability has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0 and classified as critical. This vulnerab CVE-2024-335226.7In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 a CVE-2024-335254.3A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS