FortiWeb - Relative path traversal in web API

2023-02-1600:00:00

FortiGuard Labs

www.fortiguard.com

fortiweb

api

cwe-23

path traversal

vulnerability

unauthenticated attacker

file system

0.001 Low

EPSS

Percentile

27.5%

JSON

A path traversal vulnerability [CWE-23] in the API of FortiWeb may allow a unauthenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests.

CPENameOperatorVersion
fortiwebeq7.0.1
fortiwebeq7.0.0
fortiwebeq6.4.3
fortiwebeq6.4.2
fortiwebeq6.4.1
fortiwebeq6.4.0
fortiwebeq6.3.9
fortiwebeq6.3.8
fortiwebeq6.3.7
fortiwebeq6.3.6

Name	Operator	Version
fortiweb	eq	7.0.1
fortiweb	eq	7.0.0
fortiweb	eq	6.4.3
fortiweb	eq	6.4.2
fortiweb	eq	6.4.1
fortiweb	eq	6.4.0
fortiweb	eq	6.3.9
fortiweb	eq	6.3.8
fortiweb	eq	6.3.7
fortiweb	eq	6.3.6

Rows per page:

1-10 of 491

0.001 Low

EPSS

Percentile

27.5%

JSON

Related for FG-IR-22-146