Lucene search

[email protected]CVE-2022-30299

HistoryFeb 16, 2023 - 7:15 p.m.

CVE-2022-30299

2023-02-1619:15:12

CWE-22

CWE-23

[email protected]

web.nvd.nist.gov

cve-2022-30299

path traversal vulnerability

fortiweb

api

cwe-23

nvd

security issue

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.2%

JSON

A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests.

Affected configurations

NVD

Node

fortinetfortiwebRange6.0.0–6.0.8

fortinetfortiwebRange6.1.0–6.1.3

fortinetfortiwebRange6.2.0–6.2.7

fortinetfortiwebRange6.3.0–6.3.20

fortinetfortiwebMatch6.4.0

fortinetfortiwebMatch6.4.1

fortinetfortiwebMatch6.4.2

fortinetfortiwebMatch7.0.0

fortinetfortiwebMatch7.0.1

CPENameOperatorVersion
fortinet:fortiwebfortinet fortiweble6.0.8
fortinet:fortiwebfortinet fortiweble6.1.3
fortinet:fortiwebfortinet fortiweble6.2.7
fortinet:fortiwebfortinet fortiweblt6.3.20
fortinet:fortiwebfortinet fortiwebeq6.4.0
fortinet:fortiwebfortinet fortiwebeq6.4.1
fortinet:fortiwebfortinet fortiwebeq6.4.2
fortinet:fortiwebfortinet fortiwebeq7.0.0
fortinet:fortiwebfortinet fortiwebeq7.0.1

CPE	Name	Operator	Version
fortinet:fortiweb	fortinet fortiweb	le	6.0.8
fortinet:fortiweb	fortinet fortiweb	le	6.1.3
fortinet:fortiweb	fortinet fortiweb	le	6.2.7
fortinet:fortiweb	fortinet fortiweb	lt	6.3.20
fortinet:fortiweb	fortinet fortiweb	eq	6.4.0
fortinet:fortiweb	fortinet fortiweb	eq	6.4.1
fortinet:fortiweb	fortinet fortiweb	eq	6.4.2
fortinet:fortiweb	fortinet fortiweb	eq	7.0.0
fortinet:fortiweb	fortinet fortiweb	eq	7.0.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.19",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.1.0",
        "lessThanOrEqual": "6.1.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.8",
        "status": "affected"
      }
    ]
  }
]