Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, 7.2.1 through 7.2.11, FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6, 7.2 all versions, and FortiManager Cloud 7.6.2 through 7.6.4 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged users execute arbitrary commands via crafted requests, exploit requires low privileged user access.
Update to the latest available versions of FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud.
Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.
A CVE describes the software, not your exposure. Panop discovers whether you run the affected product, then tests whether an attacker can actually reach it.
