CVE-2024-48890

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted playbook

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Fortinet	FortiSOAR	7.5.0

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-415Vendor Advisory

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488917.0An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR 7.6.0 thro CVE-2024-488924.9A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an au CVE-2024-488935.4An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 CVE-2024-488947.5A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP CVE-2024-488958.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version CVE-2024-488964.3A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may no CVE-2024-488974.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permiss CVE-2024-488984.3A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they CVE-2024-488994.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses tha CVE-2024-48904.9A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerabi CVE-2024-489004.3A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access CVE-2024-489014.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have pe