Buffer Overflow Vulnerability in Fortinet FortiAnalyzer and FortiManager Products
CVE-2021-24022

6.7MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortinet Fortianalyzer, Fortimanager
Vendor
CVE Published:
20 July 2021

Summary

A buffer overflow vulnerability exists in Fortinet's FortiAnalyzer and FortiManager Command Line Interface (CLI). This issue can be exploited by an authenticated local attacker who executes the 'diagnose system geoip-city' command with a disproportionately large IP value, potentially leading to a Denial of Service. Affected versions include FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, and 6.0.x, as well as FortiManager CLI 6.4.5 and below, 6.2.7 and below, and 6.0.x. Users are advised to apply the appropriate updates to mitigate this risk.

Affected Version(s)

Fortinet FortiAnalyzer, FortiManager FortiAnalyzer 6.4.5 and below, 6.2.7 and below, 6.0.x; FortiManager 6.4.5 and below, 6.2.7 and below, 6.0.x

References

https://fortiguard.com/advisory/FG-IR-20-194
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.