CVE-2023-23778

2023-02-1619:15:14

CWE-23

CWE-22

[email protected]

web.nvd.nist.gov

cve-2023-23778

cwe-23

nvd

fortiweb

security vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

JSON

A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests.

CPE configuration

NVD

fortinetfortiwebRange6.2.3–6.2.7

fortinetfortiwebRange6.3.0–6.3.21

fortinetfortiwebMatch6.4.0

fortinetfortiwebMatch6.4.1

fortinetfortiwebMatch6.4.2

fortinetfortiwebMatch7.0.0

fortinetfortiwebMatch7.0.1

CPENameOperatorVersion
fortinet:fortiwebfortinet fortiweble6.2.7
fortinet:fortiwebfortinet fortiweble6.3.21
fortinet:fortiwebfortinet fortiwebeq6.4.0
fortinet:fortiwebfortinet fortiwebeq6.4.1
fortinet:fortiwebfortinet fortiwebeq6.4.2
fortinet:fortiwebfortinet fortiwebeq7.0.0
fortinet:fortiwebfortinet fortiwebeq7.0.1

CPE	Name	Operator	Version
fortinet:fortiweb	fortinet fortiweb	le	6.2.7
fortinet:fortiweb	fortinet fortiweb	le	6.3.21
fortinet:fortiweb	fortinet fortiweb	eq	6.4.0
fortinet:fortiweb	fortinet fortiweb	eq	6.4.1
fortinet:fortiweb	fortinet fortiweb	eq	6.4.2
fortinet:fortiweb	fortinet fortiweb	eq	7.0.0
fortinet:fortiweb	fortinet fortiweb	eq	7.0.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiWeb",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.3.0",
        "lessThanOrEqual": "6.3.21",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.3",
        "lessThanOrEqual": "6.2.7",
        "status": "affected"
      }
    ]
  }
]