Fortinet FortiManager and FortiAnalyzer SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Fortinet FortiManager and FortiAnalyzer products. This vulnerability allows an authenticated attacker with high privileges to extract database information by sending crafted requests. The issue is present in FortiManager versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, and 6.4 all versions. FortiManager Cloud versions 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, and 6.4 all versions are also affected. Similarly, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, and 6.4 all versions are vulnerable, along with FortiAnalyzer Cloud versions 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, and 6.4 all versions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to database information, allowing attackers to extract sensitive data from the FortiManager or FortiAnalyzer database.

Remediation

Users can upgrade FortiManager or FortiAnalyzer to the latest versions: FortiManager 7.6.2 or above, FortiManager 7.4.7 or above, FortiAnalyzer 7.6.2 or above, or FortiAnalyzer 7.4.7 or above. For FortiManager and FortiAnalyzer versions 7.2, 7.0, and 6.4, users should migrate to a fixed release.