CVE-2024-55597
Published: 11 March 2025
Summary
CVE-2024-55597 is a medium-severity Path Traversal (CWE-22) vulnerability in Fortinet Fortiweb. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching and flaw remediation to fix the specific path traversal vulnerability in Fortinet FortiWeb versions 7.0.0 through 7.6.0 as detailed in the vendor advisory.
Enforces input validation at entry points to block crafted pathnames that traverse restricted directories and enable unauthorized code execution.
Monitors and controls network communications to filter crafted requests exploiting the path traversal vulnerability over the network (AV:N).
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing FortiWeb enables crafted requests for unauthorized code/command execution, mapping to exploitation of internet-facing applications (T1190) and command/scripting interpreters (T1059).
NVD Description
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.
Deeper analysisAI
CVE-2024-55597 is a path traversal vulnerability (CWE-22) in Fortinet FortiWeb versions 7.0.0 through 7.6.0. The issue arises from an improper limitation of a pathname to a restricted directory, which allows attackers to execute unauthorized code or commands via crafted requests.
The vulnerability has a CVSS v3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). It can be exploited over the network by an attacker with high privileges, requiring low complexity and no user interaction. Successful exploitation enables low integrity impact and high availability impact, with no confidentiality impact.
Mitigation details are provided in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-439.
Details
- CWE(s)