Log in Start free

Vulnerability · Published Jan 14, 2025 · Assigned by fortinet

CVE-2024-52969

Low 3.7

In plain English

A low-severity SQL injection in FortiSIEM from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 56.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below Update/Create Case feature may allow an authenticated attacker to extract database information via crafted requests.

Affected products (as reported)

VendorProductVersions
Fortinet FortiSIEM 7.1.0 – through 7.1.77.0.0 – through 7.0.36.7.0 – through 6.7.96.6.0 – through 6.6.56.5.0 – through 6.5.36.4.0 – through 6.4.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N/E:P/RL:X/RC:R

References