Lucene search

[email protected]CVE-2023-27993

HistoryMay 03, 2023 - 10:15 p.m.

CVE-2023-27993

2023-05-0322:15:18

CWE-22

CWE-23

[email protected]

web.nvd.nist.gov

cve-2023-27993

fortinet fortiadc

relative path traversal

cwe-23

privileged attacker

arbitrary directories

command line interface

nvd

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.6%

JSON

A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands.

Affected configurations

NVD

Node

fortinetfortiadcRange5.2.0–7.0.5

fortinetfortiadcRange7.1.0–7.1.2

fortinetfortiadcMatch7.2.0

CPENameOperatorVersion
fortinet:fortiadcfortinet fortiadcle7.0.5
fortinet:fortiadcfortinet fortiadclt7.1.2
fortinet:fortiadcfortinet fortiadceq7.2.0

CPE	Name	Operator	Version
fortinet:fortiadc	fortinet fortiadc	le	7.0.5
fortinet:fortiadc	fortinet fortiadc	lt	7.1.2
fortinet:fortiadc	fortinet fortiadc	eq	7.2.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiADC",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.1.0",
        "lessThanOrEqual": "7.1.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.1.0",
        "lessThanOrEqual": "6.1.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.4.0",
        "lessThanOrEqual": "5.4.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.3.0",
        "lessThanOrEqual": "5.3.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "5.2.0",
        "lessThanOrEqual": "5.2.8",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-23-069

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.6%

JSON

Related for CVE-2023-27993

cvelist1 nvd1 prion1 fortinet1