CVE-2024-48885
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A path traversal vulnerability in Fortinet FortiRecorder, FortiVoice, and FortiWeb allows an attacker to escalate privileges via specially crafted packets.
Risk Assessment
An attacker can gain unauthorized access to files and directories outside the restricted scope, potentially leading to device compromise and data confidentiality breach.
Recommendation
Immediately update the software to a patched version as recommended by the vendor (Fortinet).
Original NVD description (English source)
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.