CVE-2024-50571

HighCVSS 7.2/10Last modified Oct 22, 2026

Description

A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2025
Last modified
Oct 22, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-505727.2A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-505735.4In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized servicesCVE-2024-505747.5In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityCVE-2024-505756.1In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APICVE-2024-505765.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestCVE-2024-505775.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsCVE-2024-505785.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards pageCVE-2024-505796.1In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possibleCVE-2024-50585.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPDeveloper Typing Text allows CVE-2024-505805.4In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleCVE-2024-505815.4In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tagCVE-2024-505825.4In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
CVE-2024-50571: High severity, CVSS 7.2 | Vulnix