PT-2025-11276 · Fortinet · Fortiweb

Published 2022-04-11 · Updated 2025-03-14 · CVE-2022-29059

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.1 and below FortiWeb versions 6.4.2 and below FortiWeb versions 6.3.20 and below FortiWeb versions 6.2.7 and below

Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This may allow a privileged attacker to execute SQL commands over the log database via specifically crafted string parameters.

Recommendations: For FortiWeb versions 7.0.1 and below, update to a version above 7.0.1 to resolve the issue. For FortiWeb versions 6.4.2 and below, update to a version above 6.4.2 to resolve the issue. For FortiWeb versions 6.3.20 and below, update to a version above 6.3.20 to resolve the issue. For FortiWeb versions 6.2.7 and below, update to a version above 6.2.7 to resolve the issue. As a temporary workaround, consider restricting access to the log database to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-02826

CVE-2022-29059

Affected Products

Fortiweb

References · 7

• https://osv.dev/vulnerability/CVE-2022-29059 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02826 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29059 · Security Note
• https://twitter.com/CVEnew/status/1900582061842616452 · Twitter Post
• https://vuldb.com/?id.299743 · Note
• https://t.me/cvedetector/20323 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-22-140 · Note