CyberCVE

CVE-2024-48884

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1

Severity
Medium 6.7
CVSS 3.1
Remote · no auth what this means
Exploited
Not listed
EPSS
0.152
96.8th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jan 14, 2025
Assigned by fortinet

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder

Weakness: CWE-22

Affected products

Vendor Product Category Matched by
Fortinet FortiManager Check your version Network & Security Management cna-assigner
Fortinet FortiOS Check your version Firewall / NGFW cna-assigner
Fortinet FortiProxy Check your version SASE / SSE / Secure Web cna-assigner
Vendor-reported products (4)
  • Fortinet · FortiOS
  • Fortinet · FortiProxy
  • Fortinet · FortiManager
  • Fortinet · FortiManager Cloud

Credit

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.

Vendor remediation

Upgrade to FortiProxy version 7.4.6 or above Upgrade to FortiProxy version 7.2.12 or above Upgrade to FortiProxy version 7.0.19 or above Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.5 or above Upgrade to FortiOS version 7.2.10 or above Upgrade to FortiOS version 7.0.16 or above Upgrade to FortiOS version 6.4.16 or above Upgrade to FortiManager version 7.6.2 or above Upgrade to FortiManager version 7.4.4 or above Upgrade to FortiManager Cloud version 7.4.4 or above

References

Something wrong here?