PT-2025-1186 · Fortinet · Fortimanager Cloud+3

Published

2025-01-14

·

Updated

2025-08-08

·

CVE-2024-48884

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions FortiManager versions 7.6.0 through 7.6.1 FortiManager versions 7.4.1 through 7.4.3 FortiOS versions 7.6.0 FortiOS versions 7.4.0 through 7.4.4 FortiOS versions 7.2.5 through 7.2.9 FortiOS versions 7.0.0 through 7.0.15 FortiOS versions 6.4.0 through 6.4.15 FortiProxy versions 7.4.0 through 7.4.5 FortiProxy versions 7.2.0 through 7.2.11 FortiProxy versions 7.0.0 through 7.0.18 FortiProxy versions 2.0.0 through 2.0.14 FortiProxy versions 1.2.0 through 1.2.13 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.0.0 through 1.0.7 FortiManager Cloud versions 7.4.1 through 7.4.3
Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'path traversal'. This allows an attacker to trigger an escalation of privilege via specially crafted packets. A remote authenticated attacker with access to the security fabric interface and port may be able to write arbitrary files, and a remote unauthenticated attacker with the same network access may be able to delete an arbitrary folder.
Recommendations For FortiManager versions 7.6.0 through 7.6.1, update to a version outside of this range to mitigate the risk. For FortiManager versions 7.4.1 through 7.4.3, update to a version outside of this range to mitigate the risk. For FortiOS versions 7.6.0, update to a version outside of this range to mitigate the risk. For FortiOS versions 7.4.0 through 7.4.4, update to a version outside of this range to mitigate the risk. For FortiOS versions 7.2.5 through 7.2.9, update to a version outside of this range to mitigate the risk. For FortiOS versions 7.0.0 through 7.0.15, update to a version outside of this range to mitigate the risk. For FortiOS versions 6.4.0 through 6.4.15, update to a version outside of this range to mitigate the risk. For FortiProxy versions 7.4.0 through 7.4.5, update to a version outside of this range to mitigate the risk. For FortiProxy versions 7.2.0 through 7.2.11, update to a version outside of this range to mitigate the risk. For FortiProxy versions 7.0.0 through 7.0.18, update to a version outside of this range to mitigate the risk. For FortiProxy versions 2.0.0 through 2.0.14, update to a version outside of this range to mitigate the risk. For FortiProxy versions 1.2.0 through 1.2.13, update to a version outside of this range to mitigate the risk. For FortiProxy versions 1.1.0 through 1.1.6, update to a version outside of this range to mitigate the risk. For FortiProxy versions 1.0.0 through 1.0.7, update to a version outside of this range to mitigate the risk. For FortiManager Cloud versions 7.4.1 through 7.4.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the security fabric interface and port to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-00469
CVE-2024-48884

Affected Products

Fortimanager
Fortimanager Cloud
Fortios
Fortiproxy