PT-2022-3648 · Fortinet · Fortideceptor
Published
2022-07-05
·
Updated
2022-07-27
·
CVE-2022-30302
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FortiDeceptor versions 1.0.0 through 4.0.1
Description
The issue is related to relative path traversal errors in the management interface, allowing a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests. This can be achieved by sending crafted web requests to vulnerable API endpoints, such as
/api/v1/files, to access or modify files outside the intended directory. The filename variable can be manipulated to traverse directories and access sensitive data.Recommendations
For FortiDeceptor versions 1.0.0 through 3.2.x, update to a version outside of this range to mitigate the risk.
For FortiDeceptor versions 3.3.0 through 3.3.2, update to a version outside of this range to mitigate the risk.
For FortiDeceptor versions 4.0.0 through 4.0.1, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.
Fix
Path traversal
Relative Path Traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fortideceptor