CVE-2024-55597 — Path Traversal in Fortinet Fortiweb

CWE-22 — Path Traversal4 documents4 sources
Severity
7.2HIGHNVD
CNA5.5
EPSS
0.3%
top 46.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedMar 11

Description

A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortiweb7.0.0 — 7.4.6+1
▶CVEListV5fortinet/fortiweb7.4.0 — 7.4.5+3

🔴Vulnerability Details

2
CVEList
CVE-2024-55597: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7↗2025-03-11
▶
GHSA
GHSA-gh94-277f-f7j3: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7↗2025-03-11
▶

📋Vendor Advisories

1
Fortinet
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 thr...↗2025-03-11
▶