PT-2022-5758 · Fortinet · Fortiap-U Cli

Published 2022-07-07 · Updated 2022-07-27 · CVE-2022-30301

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiAP-U CLI versions 5.4.0 through 5.4.6 FortiAP-U CLI versions 6.0.0 through 6.0.4 FortiAP-U CLI versions 6.2.0 through 6.2.3

Description A path traversal vulnerability in FortiAP-U CLI is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow an attacker to gain unauthorized access to read, modify, and delete files and execute arbitrary commands. This vulnerability may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands.

Recommendations For FortiAP-U CLI versions 5.4.0 through 5.4.6, update to a version outside of this range to mitigate the risk. For FortiAP-U CLI versions 6.0.0 through 6.0.4, update to a version outside of this range to mitigate the risk. For FortiAP-U CLI versions 6.2.0 through 6.2.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-07157

CVE-2022-30301

Affected Products

Fortiap-U Cli

References · 7

• https://fortiguard.com/psirt/FG-IR-22-109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30301 · Security Note
• https://bdu.fstec.ru/vul/2022-07157 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30301 · Vendor Advisory
• https://t.me/cvenotify/33392 · Telegram Post
• https://t.me/cvenotify/33840 · Telegram Post
• https://t.me/cibsecurity/46553 · Telegram Post