CVE-2024-35275
published 2025-01-14CVE-2024-35275: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager…
PriorityP356high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.80%
52.6th percentile
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortianalyzer | — | — |
| fortinet | fortianalyzer | >= 7.4.0 < 7.4.4 | 7.4.4 |
| fortinet | fortianalyzer | 7.4.0 – 7.4.3 | — |
| fortinet | fortianalyzer_cloud | >= 7.4.1 < 7.4.3 | 7.4.3 |
| fortinet | fortianalyzercloud | — | — |
| fortinet | fortimanager | — | — |
| fortinet | fortimanager | >= 7.4.0 < 7.4.3 | 7.4.3 |
| fortinet | fortimanager | 7.4.0 – 7.4.2 | — |
| fortinet | fortimanager_cloud | >= 7.4.1 < 7.4.3 | 7.4.3 |
| fortinet | fortimanagercloud | — | — |
| fortinet | fortinet | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
SQL injections in sdnproxy daemon
vendor_fortinet·2025-01-14·CVSS 6.6
CVE-2024-35275 [MEDIUM] CWE-89 SQL injections in sdnproxy daemon
FG-IR-24-091: SQL injections in sdnproxy daemon
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
CVEs: CVE-2024-35275
CWEs: CWE-89
CVSS: 6.6 (medium)
Affected products: FortiAnalyzer, FortiAnalyzercloud, FortiManager, FortiManagercloud, Fortinet
GHSA
GHSA-rp6x-j4c5-4rvc: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7
ghsa_unreviewed·2025-01-14
CVE-2024-35275 [MEDIUM] CWE-89 GHSA-rp6x-j4c5-4rvc: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, FortiManager version 7.4.0 through 7.4.2 allows attacker to escalation of privilege via specially crafted http requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-01-14
Published