CVE-2024-32115
A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via
Severity
Medium 5.2
CVSS 3.1
Exploited
Not listed
EPSS
0.011
63.2th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jan 14, 2025
Assigned by fortinet
Description
A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Weakness: CWE-23
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiManager | Network & Security Management | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiManager
Credit
Internally discovered and reported by Théo Leleu of Fortinet Product Security team.
Vendor remediation
Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above