CVE-2024-45331

HighCVSS 7.8/10Last modified Jul 8, 2026

Description

A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1 through 7.2.6, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalate privilege via specific shell commands

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
Fortinet	FortiAnalyzer Cloud	>= 7.4.1, <= 7.4.2; >= 7.2.1, <= 7.2.6; >= 7.0.1, <= 7.0.16; >= 6.4.1, <= 6.4.7
Fortinet	FortiManager	>= 7.4.0, <= 7.4.2; >= 7.2.0, <= 7.2.5; >= 7.0.0, <= 7.0.16; >= 6.4.0, <= 6.4.15
Fortinet	FortiAnalyzer	>= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.5; >= 7.0.0, <= 7.0.16; >= 6.4.0, <= 6.4.15

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-127Vendor Advisory

Timeline

Published: Jan 16, 2025
Last modified: Jul 8, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-453325.6Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution in the indirect br CVE-2024-453337.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver before version 31.0.101.4314 may allow an authentic CVE-2024-453347.8Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthori CVE-2024-453355.5Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viru CVE-2024-453366.1The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorizatio CVE-2024-453379.1Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible CVE-2024-453385.3An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremel CVE-2024-453397.1When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file pat CVE-2024-45346.1The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing sanitisation as well as es CVE-2024-453408.8Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credenti CVE-2024-453416.1A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certifica CVE-2024-453468.8The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day Initia