CVE-2024-48890: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7…

PriorityP261high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.10%

61.9th percentile

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted playbook

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortisoar	—	—
fortinet	fortisoar	—	—
fortinet	fortisoar_imap_connector	< 3.5.8	3.5.8
fortinet	fortisoarimapconnector	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is triggered via a specifically crafted playbook in FortiSOAR; monitor for unusual or unauthorized playbook execution involving the IMAP connector, particularly those invoking OS-level commands. ↗
→Target component is the FortiSOAR IMAP connector version 3.5.7 and below (CWE-78 OS Command Injection); audit installed connector versions and flag any instance at or below 3.5.7. ↗

·Exploitation requires authentication; attack surface is limited to authenticated users who have permission to create or execute playbooks within FortiSOAR. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.