Fortinet PSIRT Monthly Advisories — January 2025
Tuesday, 14 January 2025
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
Critical 9.6
CVE-2024-55591 Zero-day Public exploit Scanner template An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…EPSS 94%
Critical 1
- Critical 9.6
All vulnerabilities 51
Critical2 ShowHide
-
Critical 9.6
CVE-2024-55591 Zero-day Public exploit Scanner template An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0…EPSS 94%
- Critical 9.6
High13 ShowHide
- High 8.6
- High 8.4
- High 8.3
- High 8.3
- High 8.0
- High 7.9
- High 7.7
- High 7.6
- High 7.5
-
High 7.2
CVE-2024-50566 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, …EPSS 1.1%
- High 7.1
- High 7.0
-
High 7.0
CVE-2024-36512 An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer 7.4.0 through 7.4.3 and 7.2.0 through…EPSS 1.4%
Medium27 ShowHide
- Medium 6.9
- Medium 6.9
- Medium 6.7
-
Medium 6.7
CVE-2024-48884 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1…EPSS 15%
- Medium 6.7
- Medium 6.5
- Medium 6.5
- Medium 6.4
- Medium 6.4
-
Medium 6.4
CVE-2024-33502 An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 and 7.2.…EPSS 1.3%
- Medium 6.4
- Medium 6.4
- Medium 6.3
- Medium 6.3
-
Medium 6.3
CVE-2024-48890 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 …EPSS 1.2%
- Medium 6.2
- Medium 6.1
-
Medium 5.2
CVE-2024-32115 A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete f…EPSS 1.1%
- Medium 5.2
- Medium 5.2
- Medium 5.1
- Medium 5.0
- Medium 4.9
- Medium 4.8
- Medium 4.8
- Medium 4.7
- Medium 4.1
Low9 ShowHide
- Low 3.9
- Low 3.7
- Low 3.5
- Low 3.5
- Low 3.5
- Low 3.3
- Low 3.2
- Low 3.2
- Low 2.6