Vulnerability · Published Jan 16, 2025 · Assigned by fortinet
CVE-2024-48885
Medium 5.2
In plain English
A medium-severity path traversal in FortiRecorder from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiVoice | 7.0.0 – through 7.0.46.4.0 – through 6.4.96.0.0 – through 6.0.12 |
| Fortinet | FortiRecorder | 7.2.0 – through 7.2.17.0.0 – through 7.0.4 |
| Fortinet | FortiWeb | 7.6.07.4.0 – through 7.4.47.2.0 – through 7.2.127.0.0 – through 7.0.126.4.0 – through 6.4.3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C