FortiWeb - Path traversal in API controller

2023-02-1600:00:00

FortiGuard Labs

www.fortiguard.com

fortiweb

api

path traversal

cwe-23

authenticated attacker

file retrieval

web requests

vulnerability

software

0.001 Low

EPSS

Percentile

30.7%

JSON

A relative path traversal vulnerability [CWE-23] in the API of FortiWeb may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

CPENameOperatorVersion
fortiwebeq7.0.2
fortiwebeq7.0.1
fortiwebeq7.0.0
fortiwebeq6.4.3
fortiwebeq6.4.2
fortiwebeq6.4.1
fortiwebeq6.4.0
fortiwebeq6.3.9
fortiwebeq6.3.8
fortiwebeq6.3.7

Name	Operator	Version
fortiweb	eq	7.0.2
fortiweb	eq	7.0.1
fortiweb	eq	7.0.0
fortiweb	eq	6.4.3
fortiweb	eq	6.4.2
fortiweb	eq	6.4.1
fortiweb	eq	6.4.0
fortiweb	eq	6.3.9
fortiweb	eq	6.3.8
fortiweb	eq	6.3.7

Rows per page:

1-10 of 221

0.001 Low

EPSS

Percentile

30.7%

JSON

Related for FG-IR-22-251