CVE-2024-36508

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 CLI allows an authenticated admin user with diagnose privileges to delete files on the system.

Score

CVSS 3.1 6.0 Medium

Status

Analyzed - psirt@fortinet.com

Published

2025-02-11

Last modified

2025-02-12

Weaknesses

CWE-22

Affected products

• Fortianalyzer (Fortinet)
• Fortimanager (Fortinet)

References

• https://fortiguard.fortinet.com/psirt/FG-IR-24-147