{"id":"CVE-2024-33503","aliases":["EUVD-2024-31241","GHSA-hw72-fmxv-278r"],"status":"published","title":"A improper privilege management in Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0...","description":"A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00216,"percentile":0.12137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2025-01-14T14:09:33Z","modified":"2026-07-08T14:16:51Z","products":[{"vendor":"fortinet","product":"fortianalyzer"},{"vendor":"fortinet","product":"fortianalyzer_cloud"},{"vendor":"fortinet","product":"fortimanager"},{"vendor":"fortinet","product":"fortimanager cloud"},{"vendor":"fortinet","product":"fortimanager_cloud"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-127","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33503"},{"url":"https://github.com/advisories/GHSA-hw72-fmxv-278r"}],"sources":{"cve":[{"id":"CVE-2024-33503","description":"A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands","status":"published","published":"2025-01-14T14:09:33.613Z","modified":"2026-07-08T12:59:10.104Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-31241","description":"A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands","status":"published","published":"2025-01-14T14:09:33Z","modified":"2026-07-08T12:59:10Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T18:20:11.058935Z"}],"ghsa":[{"id":"GHSA-hw72-fmxv-278r","title":"A improper privilege management in Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0...","description":"A improper privilege management in Fortinet FortiManager version 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to escalation of privilege via specific shell commands","status":"published","published":"2025-01-14T15:30:52Z","modified":"2025-01-14T15:31:02Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:59:29.545169Z"}],"nvd":[{"id":"CVE-2024-33503","description":"A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands","status":"published","published":"2025-01-14T14:15:29.517Z","modified":"2026-07-08T14:16:51.74Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:10:42.329342Z"}]}}