Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2024-55597: FortiWeb versions 7.0.0-7.6.0 allow attackers to run unauthorized code
CVE-2024-55597 · published 1 year ago
Summary
Attackers can execute unauthorized code or commands on FortiWeb if they send a specially crafted request. This can lead to unauthorized actions on the system. Fortinet recommends updating to a fixed version to prevent this issue.
What to do
- Update fortinet fortiweb to version 7.4.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortiweb |
>= 7.0.0, < 7.4.6 7.6.0 cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:* |
Original advisory text
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via craft...
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted requests.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-439 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published11 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-55597 · NVD
Track software like this
Free during beta