CVE-2024-44599
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-23
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fntsoftware | fnt_command | to 13.4.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2024-44599 is a directory traversal vulnerability in FNT Command versions up to and including 13.4.0. It occurs because the software does not properly validate user-supplied file paths during file upload handling. This allows an authenticated attacker to upload files to arbitrary locations on the server outside the intended upload directory. [2]
How can this vulnerability impact me? :
This vulnerability can lead to full system compromise, including remote code execution. Attackers can upload executable files or overwrite security-critical resources, potentially causing high impact on system integrity and availability. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring for unauthorized file uploads or unexpected file placements outside the intended upload directories. You can check server logs for suspicious file upload activity and scan for files in directories where uploads should not occur. Specific commands depend on your environment, but for example, on a Linux system, you might use commands like 'find /path/to/upload -type f -exec ls -l {} \;' to list files, or 'grep' to search logs for upload attempts. Additionally, monitoring network traffic for unusual POST requests to the upload endpoint may help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating FNT Command to a version later than 13.4.0 where the vulnerability is fixed, as the vendor has addressed the issue. Until an update can be applied, restrict access to the upload functionality to trusted users only, implement strict input validation on file paths, and monitor for suspicious upload activity. Additionally, consider applying network-level controls such as firewall rules to limit access to the vulnerable service. [2]