SQL Injection Vulnerability in FortiManager and FortiAnalyzer Products
CVE-2025-24474

2.6LOW

Key Information:

Vendor

Fortinet
Status
Fortimanager
Fortianalyzer
Vendor
CVE Published:
8 July 2025

What is CVE-2025-24474?

An SQL injection vulnerability in FortiManager and FortiAnalyzer products allows authenticated attackers with elevated privileges to craft requests that may extract sensitive database information. This vulnerability affects multiple versions, including various release cycles of both FortiManager and FortiAnalyzer products, as well as their cloud counterparts.

Affected Version(s)

FortiAnalyzer 7.6.0 <= 7.6.1

FortiAnalyzer 7.4.0 <= 7.4.6

FortiAnalyzer 7.2.0 <= 7.2.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-437

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-24474 : SQL Injection Vulnerability in FortiManager and FortiAnalyzer Products