A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.
CVSS Details
- CVSS 3.1 Base Score: 5.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortimanager | — | Upgrade FortiManager to 7.4.4Upgrade FortiManager to 7.6.2 | Feb 6, 2025 | Jan 14, 2025 |
| Fortinet Fortiweb | — | Upgrade FortiWeb to 7.6.1Upgrade to the latest version of FortiWebUpgrade FortiWeb to 7.4.5 | Jul 2, 2026 | Jan 14, 2025 |
| Fortios | — | Upgrade FortiOS to 7.0.16Upgrade FortiOS to 7.6.1Upgrade FortiOS to 6.4.16Upgrade FortiOS to 7.4.5Upgrade FortiOS to 7.2.10 | Feb 6, 2025 | Jan 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub