CVE-2024-48884
Published: 14 January 2025
Summary
CVE-2024-48884 is a high-severity Path Traversal (CWE-22) vulnerability in Fortinet Fortios. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-48884 is a path traversal vulnerability, tracked as CWE-22, that affects Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS releases 7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.9, 7.0.0-7.0.15, and 6.4.0-6.4.15, plus FortiProxy versions 7.4.0-7.4.5, 7.2.0-7.2.11, 7.0.0-7.0.18, 2.0, and all 1.x releases. The flaw arises from improper limitation of pathnames to restricted directories and carries a CVSS 3.1 score of 7.5.
A remote authenticated attacker who can reach the security fabric interface and port may write arbitrary files, while a remote unauthenticated attacker may delete an arbitrary folder, resulting in high availability impact. The current EPSS score of 0.5028 matches its recorded peak with no material rise from a lower baseline.
The Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-259 addresses mitigation steps for the affected products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43232
Vulnerability details
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0.0…
more
through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, FortiProxy 7.2.0 through 7.2.11, FortiProxy 7.0.0 through 7.0.18, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary files or a remote unauthenticated attacker to delete an arbitrary folder
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables remote unauthenticated exploitation of exposed Fortinet interfaces (T1190), authenticated arbitrary file write for tool transfer (T1105), and unauthenticated arbitrary folder deletion (T1070.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates file path inputs to ensure they remain within authorized directories, preventing path traversal exploitation.
Mandates timely flaw remediation, including patching this specific path traversal vulnerability as detailed in the vendor advisory.
Enforces logical access controls on file system resources to block unauthorized writes or deletes attempted via traversed paths.