PT-2023-1500 · Fortinet · Fortiweb

CVE-2022-30300 · Publicado 2023-02-16 · Atualizado 2023-02-24

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.6 through 6.3.18 FortiWeb versions 6.4 FortiWeb versions 7.0.0 through 7.0.1

Description The issue is related to a relative path traversal vulnerability in FortiWeb, which may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests. This is due to incorrect restriction of the directory path name with limited access.

Recommendations For FortiWeb versions 6.3.6 through 6.3.18, update to a version outside of this range to resolve the issue. For FortiWeb versions 6.4, update to a version outside of this range to resolve the issue. For FortiWeb versions 7.0.0 through 7.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to specifically crafted HTTP GET requests until a patch is available.

Correção

Relative Path Traversal

Path traversal

Enumeração de Fraquezas

CWE-23

CWE-22

Identificadores relacionados

BDU:2023-00922

CVE-2022-30300

Produtos afetados

Fortiweb

Referências · 5

• https://bdu.fstec.ru/vul/2023-00922 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-30300 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-22-136 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-30300 · Nota de Segurança
• https://t.me/cibsecurity/58347 · Publicação no Telegram