PT-2023-1737 · Fortinet · Fortirecorder+1

Publicado 2023-03-07 · Atualizado 2023-03-14 · CVE-2022-22297

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.0 through 6.4.1 FortiRecorder versions 2.7 through 6.4.3

Description The issue is related to an incomplete filtering of one or more instances of special elements in the command line interpreter. This may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Recommendations For FortiWeb versions 6.0 through 6.4.1, update to a version that includes the fix for this issue. For FortiRecorder versions 2.7 through 6.4.3, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the command line interpreter to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-792

Identificadores relacionados

BDU:2023-01328

CVE-2022-22297

Produtos afetados

Fortirecorder

Fortiweb

Referências · 5

• https://osv.dev/vulnerability/CVE-2022-22297 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-22297 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-21-218 · Aviso do Fabricante
• https://t.me/cibsecurity/59605 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-01328 · Nota de Segurança