PT-2023-6752 · Fortinet · Fortiweb

Published 2023-02-16 · Updated 2023-02-28 · CVE-2023-23784

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.6 through 6.3.20 FortiWeb versions 7.0.0 through 7.0.2 FortiWeb 6.4 all versions

Description The issue is related to a relative path traversal that allows information disclosure via specially crafted web requests. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow a remote attacker to disclose protected information.

Recommendations For FortiWeb versions 6.3.6 through 6.3.20, update to a version outside of this range to resolve the issue. For FortiWeb versions 7.0.0 through 7.0.2, update to a version outside of this range to resolve the issue. For FortiWeb 6.4 all versions, update to a version that is not part of the 6.4 series to resolve the issue. As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2023-07541

CVE-2023-23784

Affected Products

Fortiweb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-23784 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23784 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07541 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-251 · Vendor Advisory