What is the CVSS score of CVE-2024-48890?

CVE-2024-48890 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Fortisoar Imap Connector are affected by CVE-2024-48890?

Organizations using FortiSOAR IMAP connector should be aware of notable risk from CVE-2024-48890, a OS command injection vulnerability rated CVSS 6.6.

How to fix or mitigate CVE-2024-48890?

Within 30 days: Identify affected systems running FortiSOAR IMAP connector and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Fortisoar Imap Connector CVE-2024-48890

MEDIUM

OS Command Injection (CWE-78)

2025-01-14 psirt@fortinet.com

Command Injection Fortisoar Imap Connector

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:03 vuln.today

CVE Published

Jan 14, 2025 - 14:15 nvd

MEDIUM 6.6

DescriptionCVE.org

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted playbook

AnalysisAI

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector version 3.5.7 and below may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted playbook Affected products include: Fortinet Fortisoar Imap Connector. Version information: version 3.5.7.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.