Fortinet FortiManager: Unspecified Security Vulnerability (CVE-2024-48884)

Fortinet FortiManager: Unspecified Security Vulnerability (CVE-2024-48884)

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

01/14/2025

Created

02/11/2025

Added

02/06/2025

Modified

02/06/2025

Description

A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.

Solution(s)

• fortinet-fortimanager-upgrade-7_4_4
• fortinet-fortimanager-upgrade-7_6_2

References

• https://attackerkb.com/topics/cve-2024-48884
• CVE - 2024-48884
• https://fortiguard.fortinet.com/psirt/FG-IR-24-259