CVE-2020-29015

🗓️ 14 Jan 2021 16:07:20Reported by fortinetType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 93 Views🌐 WEB

FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 blind SQL injection vulnerability

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2020-29015	14 Jan 202118:49	–	circl
CNNVD	Fortinet FortiWeb SQL Injection Vulnerability	6 Jan 202100:00	–	cnnvd
Cvelist	CVE-2020-29015	14 Jan 202116:07	–	cvelist
EUVD	EUVD-2020-21397	7 Oct 202500:30	–	euvd
Fortinet	FortiWeb is vulnerable to a blind SQL injection	4 Jan 202100:00	–	fortinet
Tenable Nessus	Fortinet FortiWeb sqli (FG-IR-20-124)	26 Oct 202400:00	–	nessus
NVD	CVE-2020-29015	14 Jan 202116:15	–	nvd
OSV	CVE-2020-29015	14 Jan 202116:15	–	osv
Prion	Sql injection	14 Jan 202116:15	–	prion
Positive Technologies	PT-2021-3438 · Fortinet · Fortiweb	4 Jan 202100:00	–	ptsecurity

NVD

Node

fortinet fortiwebRange<6.2.4

fortinet fortiwebRange6.3.0–6.3.7

[
  {
    "product": "Fortinet FortiWeb",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4"
      }
    ]
  }
]

Source	Link
fortiguard	www.fortiguard.com/psirt/FG-IR-20-124

Parameter	Position	Path	Description	CWE
name	request body	/api/v2.0/user/remoteserver.saml	OS command injection via smuggling backticks in the Name field of the SAML Server configuration on FortiWeb management interface.	CWE-78

21 Nov 2024 05:23Current

9.9High risk

Vulners AI Score9.9

CVSS 27.5

CVSS 3.19.8

EPSS0.01005

SSVC

CWE-89