Lucene search

[email protected]CVE-2023-25608

HistorySep 13, 2023 - 1:15 p.m.

CVE-2023-25608

2023-09-1313:15:08

CWE-792

[email protected]

web.nvd.nist.gov

cve-2023-25608

fortiap-w2

command line interpreter

vulnerability

cwe-792

file reading

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.9%

JSON

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.

Affected configurations

NVD

Node

fortinetfortiapRange6.0.0–7.0.6

fortinetfortiapRange7.2.0–7.2.2

fortinetfortiap-cRange5.2.0–5.4.5

fortinetfortiap-uRange5.4.0–6.2.6

fortinetfortiap-uMatch7.0.0

fortinetfortiap-w2Range6.0.0–7.0.1

fortinetfortiap-w2Range7.0.3–7.0.6

fortinetfortiap-w2Range7.2.0–7.2.2

CPENameOperatorVersion
fortinet:fortiapfortinet fortiaplt7.0.6
fortinet:fortiapfortinet fortiaplt7.2.2
fortinet:fortiap-cfortinet fortiap-clt5.4.5
fortinet:fortiap-ufortinet fortiap-ult6.2.6
fortinet:fortiap-ufortinet fortiap-ueq7.0.0
fortinet:fortiap-w2fortinet fortiap-w2le7.0.1
fortinet:fortiap-w2fortinet fortiap-w2lt7.0.6
fortinet:fortiap-w2fortinet fortiap-w2lt7.2.2

CPE	Name	Operator	Version
fortinet:fortiap	fortinet fortiap	lt	7.0.6
fortinet:fortiap	fortinet fortiap	lt	7.2.2
fortinet:fortiap-c	fortinet fortiap-c	lt	5.4.5
fortinet:fortiap-u	fortinet fortiap-u	lt	6.2.6
fortinet:fortiap-u	fortinet fortiap-u	eq	7.0.0
fortinet:fortiap-w2	fortinet fortiap-w2	le	7.0.1
fortinet:fortiap-w2	fortinet fortiap-w2	lt	7.0.6
fortinet:fortiap-w2	fortinet fortiap-w2	lt	7.2.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiAP-W2",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.3",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-C",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.2.0",
        "lessThanOrEqual": "5.2.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.3",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-U",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.0.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.3",
        "lessThanOrEqual": "5.4.6",
        "status": "affected"
      },
      {
        "version": "5.4.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiAP-S",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.6",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-120

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.9%

JSON

Related for CVE-2023-25608

prion1 nvd1 cvelist1