CVE-2024-52964

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-529657.2A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.CVE-2024-529662.3An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause informa CVE-2024-529674.8An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiPortal 6.0.0 through 6.0.14 allows attacke CVE-2024-529688.4An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty passwo CVE-2024-529696.5An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and CVE-2024-52978.8D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar CVE-2024-529726.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/CVE-2024-529736.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entr CVE-2024-529746.5An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A succe CVE-2024-529759.0An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log leve CVE-2024-529767.8Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitra CVE-2024-529797.5Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead t