← Back

CVE-2024-48885

nvd nist
Published: Jan 16, 2025Modified: Jan 14, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.

Affected (6)

Fortinet
3 products
Fortirecorder
Fortivoice
Fortiweb
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortirecorder
From 7.0.0 to 7.0.5
Fortirecorder
From 7.2.0 to 7.2.2
Fortinet
Fortivoice
From 6.0.0 to 6.4.10
Fortivoice
From 7.0.0 to 7.0.5
Fortinet
Fortiweb
From 6.4.0 to 7.4.5
Fortiweb
Version 7.6.0

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.