FortiWeb - Path traversal in API handler

2023-02-1600:00:00

FortiGuard Labs

www.fortiguard.com

fortiweb

path traversal

api handler

authenticated attacker

unauthorized access

http get requests

files

data

0.001 Low

EPSS

Percentile

39.7%

JSON

A relative path traversal vulnerability [CWE-23] in FortiWeb may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests.

CPENameOperatorVersion
fortiwebeq7.0.1
fortiwebeq7.0.0
fortiwebeq6.4.3
fortiwebeq6.4.2
fortiwebeq6.4.1
fortiwebeq6.4.0
fortiwebeq6.3.9
fortiwebeq6.3.8
fortiwebeq6.3.7
fortiwebeq6.3.6

Name	Operator	Version
fortiweb	eq	7.0.1
fortiweb	eq	7.0.0
fortiweb	eq	6.4.3
fortiweb	eq	6.4.2
fortiweb	eq	6.4.1
fortiweb	eq	6.4.0
fortiweb	eq	6.3.9
fortiweb	eq	6.3.8
fortiweb	eq	6.3.7
fortiweb	eq	6.3.6

Rows per page:

1-10 of 191

0.001 Low

EPSS

Percentile

39.7%

JSON

Related for FG-IR-22-136