The vulnerability of Fortinet’s software products arises from incorrect restrictions on path names in restricted access catalogs, allowing attackers to escalate their privileges.

🗓️ 20 Jan 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Fortinet software vulnerability permits privilege escalation from path name restrictions in restricted access catalogs.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2024-48885	16 Jan 202509:15	–	attackerkb
Circl	CVE-2024-48885	16 Jan 202509:04	–	circl
CNNVD	Fortinet多款产品路径遍历漏洞	16 Jan 202500:00	–	cnnvd
CVE	CVE-2024-48885	16 Jan 202509:01	–	cve
Cvelist	CVE-2024-48885	16 Jan 202509:01	–	cvelist
EUVD	EUVD-2024-43233	3 Oct 202520:07	–	euvd
Tenable Nessus	Fortinet Fortigate Path traversal in csfd daemon (FG-IR-24-259)	14 Jan 202500:00	–	nessus
Tenable Nessus	Fortinet FortiWeb Path traversal in csfd daemon (FG-IR-24-259)	14 Jan 202500:00	–	nessus
Tenable Nessus	Siemens APE1808 Improper Limitation of a Pathname to a Restricted Directory (CVE-2024-48885)	23 Mar 202600:00	–	nessus
NCSC	Vulnerabilities fixed in Siemens products	11 Feb 202519:40	–	ncsc

Vulners

Node

fortinet fortiproxyMatch1.1

OR

fortinet fortiproxyMatch1.2

OR

fortinet fortiproxyMatch2.0

OR

fortinet fortiproxyMatch1.0

OR

fortinet fortivoiceMatch6.0

OR

fortinet fortimanagerRange7.6.0–7.6.2

OR

fortinet fortimanagerRange7.4.1–7.4.4

OR

fortinet fortimanager_cloudRange7.4.1–7.4.4

OR

fortinet fortiproxyRange7.4.0–7.4.6

OR

fortinet fortiproxyRange7.2.0–7.2.12

OR

fortinet fortiproxyRange7.0.0–7.0.19

OR

fortinet fortirecorderRange7.2.0–7.2.2

OR

fortinet fortirecorderRange7.0.0–7.0.5

OR

fortinet fortivoiceRange7.0.0–7.0.5

OR

fortinet fortivoiceRange6.4.0–6.4.10

OR

fortinet fortiwebRange7.6.0–7.6.1

OR

fortinet fortiwebRange7.4.0–7.4.5

OR

fortinet fortiwebMatch7.2

OR

fortinet fortiwebMatch7.0

OR

fortinet fortiwebMatch6.4

OR

fortinet fortiosMatch6.4

OR

fortinet fortiosRange7.0.0–7.0.15

OR

fortinet fortiosRange7.6.0–7.6.1

OR

fortinet fortiosRange7.4.0–7.4.5

OR

fortinet fortiosRange7.2.0–7.2.10

Source	Link
fortiguard	www.fortiguard.fortinet.com/psirt/FG-IR-24-259
web	www.web.nvd.nist.gov/view/vuln/detail

20 Jan 2025 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 24.9

CVSS 35.3

EPSS0.00769

Fortinet software path name restrictions restricted access catalogs privilege escalation crafted packages