PT-2023-6988 · Fortinet · Fortiwlm

Published 2023-11-14 · Updated 2023-11-18 · CVE-2023-42783

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.2.2 through 8.3.0 Fortinet FortiWLM versions 8.3.2 through 8.4.0 Fortinet FortiWLM versions 8.4.2 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5

Description A relative path traversal issue in Fortinet FortiWLM allows an attacker to read arbitrary files via crafted HTTP requests. This is related to errors in processing relative paths to directories. Exploitation of this issue may allow a remote attacker to read arbitrary files using specially crafted HTTP requests.

Recommendations For Fortinet FortiWLM versions 8.2.2 through 8.3.0, update to a version that fixes the relative path traversal issue. For Fortinet FortiWLM versions 8.3.2 through 8.4.0, update to a version that fixes the relative path traversal issue. For Fortinet FortiWLM versions 8.4.2 through 8.5.4, update to a version that fixes the relative path traversal issue. For Fortinet FortiWLM versions 8.6.0 through 8.6.5, update to a version that fixes the relative path traversal issue. As a temporary workaround, consider restricting access to the vulnerable HTTP endpoints until a patch is available.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

BDU:2023-08007

CVE-2023-42783

Affected Products

Fortiwlm

References · 6

• https://fortiguard.com/psirt/FG-IR-23-143 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08007 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42783 · Security Note
• https://twitter.com/CVEnew/status/1724491743465267309 · Twitter Post
• https://t.me/cvenotify/60678 · Telegram Post