CVE-2024-45331 Privilege escalation in FortiAnalyzer

What is CVE-2024-45331?

CVE-2024-45331 is a medium-severity vulnerability in Fortinet Fortianalyzer, published on 16 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1 through 7.2.6, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalate privilege via specific shell commands

Weakness: CWE-266

Which versions are affected by CVE-2024-45331?

It affects 4 products.

Products include Fortinet Fortianalyzer, Fortinet Fortianalyzer Cloud, Fortinet Fortimanager, Fortinet Fortimanager Cloud.

How do I fix CVE-2024-45331?

No fix has been published for CVE-2024-45331 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-45331 being exploited?

There is no known exploitation of CVE-2024-45331 in the wild and no public exploit code.

Other vulnerabilities in Fortinet Fortianalyzer

• CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Exploited Critical 9.4
• CVE-2023-25610 Memory corruption in FortiAnalyzer Critical 9.3
• CVE-2021-32603 Server-side request forgery in Fortinet FortiAnalyzer, FortiManager High 8.8
• CVE-2020-12817 Cross-site scripting in Fortinet FortiAnalyzer High 8.8
• CVE-2024-48886 Auth bypass in FortiOS High 8.0

All Fortinet Fortianalyzer vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rjhh-4m39-v2cg.