PT-2023-6752 · Fortinet · Fortiweb
Publicado
2023-02-16
·
Atualizado
2023-02-28
·
CVE-2023-23784
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
FortiWeb versions 6.3.6 through 6.3.20
FortiWeb versions 7.0.0 through 7.0.2
FortiWeb 6.4 all versions
Description
The issue is related to a relative path traversal that allows information disclosure via specially crafted web requests. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow a remote attacker to disclose protected information.
Recommendations
For FortiWeb versions 6.3.6 through 6.3.20, update to a version outside of this range to resolve the issue.
For FortiWeb versions 7.0.0 through 7.0.2, update to a version outside of this range to resolve the issue.
For FortiWeb 6.4 all versions, update to a version that is not part of the 6.4 series to resolve the issue.
As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.
Correção
Relative Path Traversal
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fortiweb