6.9
Medium
CVE-2024-45331 A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0…
Description
A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1 through 7.2.6, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalate privilege via specific shell commands
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiAnalyzer 7.4 | 7.4.0 → 7.4.3 | No fix stated |
| FortiAnalyzer 7.2 | 7.2.0 → 7.2.5 | No fix stated |
| FortiAnalyzer 7.0 | 7.0.0 → 7.0.16 | No fix stated |
| FortiAnalyzer 6.4 | 6.4.0 → 6.4.15 | No fix stated |
| FortiManager 7.4 | 7.4.0 → 7.4.2 | No fix stated |
| FortiManager 7.2 | 7.2.0 → 7.2.5 | No fix stated |
| FortiManager 7.0 | 7.0.0 → 7.0.16 | No fix stated |
| FortiManager 6.4 | 6.4.0 → 6.4.15 | No fix stated |
| FortiAnalyzer Cloud 7.4 | 7.4.1 → 7.4.2 | No fix stated |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiAnalyzer Cloud 7.2 | 7.2.1 → 7.2.6 | No fix stated |
| FortiAnalyzer Cloud 7.0 | 7.0.1 → 7.0.16 | No fix stated |
| FortiAnalyzer Cloud 6.4 | 6.4.1 → 6.4.7 | No fix stated |
Other CVEs of FortiAnalyzer
The 74 CVEs of FortiAnalyzer →
CVE-2026-23707
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
6.5
Medium
CVE-2025-46773
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
7.9
High
CVE-2026-23706
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
5.9
Medium
CVE-2026-23705
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89]…
6.5
Medium