CVE Daily

CVE-2024-33501

Two improper neutralization of special elements used in an SQL Command ('SQL Inj...

Medium CVSS 4.2

Overview

Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5, FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to execute unauthorized code or commands via specifically crafted CLI requests.

CWE: CWE-89 Published: 2025-03-11T15:15:41.550
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.2 (MEDIUM)
  • Detected tags: sql (tag impact: MODERATE)

Recommended actions:

  • Use parameterized queries/ORM (avoid string concatenation).
  • Add WAF rules and input validation.

Recommended tools

Tags