PT-2023-13002 · Fortinet · Fortiweb

Publicado 2023-02-16 · Atualizado 2023-02-24 · CVE-2022-30306

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.1 and below FortiWeb version 6.4 all versions FortiWeb version 6.3.19 and below

Description A stack-based buffer overflow vulnerability in the CA sign functionality may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password.

Recommendations For FortiWeb versions 7.0.1 and below, update to a version above 7.0.1 to resolve the issue. For FortiWeb version 6.4 all versions, consider disabling the CA sign functionality until a patch is available. For FortiWeb version 6.3.19 and below, update to a version above 6.3.19 to resolve the issue. As a temporary workaround, consider restricting access to the CA sign functionality to minimize the risk of exploitation.

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2022-30306

Produtos afetados

Fortiweb

Referências · 4

• https://osv.dev/vulnerability/CVE-2022-30306 · Aviso do Fabricante
• https://t.me/cibsecurity/58379 · Publicação no Telegram
• https://fortiguard.com/psirt/FG-IR-22-167 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-30306 · Nota de Segurança