Fortinet FortiWeb Arbitrary file read through command line pipe (FG-IR-21-218)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-218 advisory. - An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter o...

Fortinet FortiWeb - Double free in pipe management (FG-IR-22-348)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-348 advisory. - A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands...

Fortinet FortiWeb Relative path traversal in web API (FG-IR-22-146)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-146 advisory. - A path traversal vulnerability CWE-23 in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6....

Fortinet FortiWeb Path traversal in API handler (FG-IR-22-136)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-136 advisory. - A relative path traversal vulnerability CWE-23 in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may...

Fortinet FortiWeb Read only administrator can see passwords' hashes (FG-IR-23-191)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-191 advisory. - An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiWeb version 7.4.0, version 7.2.4...

Fortinet FortiWeb Stack-based Buffer Overflow in command line interpreter (FG-IR-21-234)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-234 advisory. - A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions...

Fortinet FortiWeb - Weak generation of WAF session IDs leads to session fixation (FG-IR-21-214)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-214 advisory. - A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3....

Fortinet FortiWeb Multiple Stack based buffer overflow in web interface (FG-IR-22-118)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-118 advisory. - A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through...

Fortinet FortiWeb Path traversal in API controller (FG-IR-22-251)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-251 advisory. - A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb...

Fortinet FortiWeb Command injection in webserver (FG-IR-22-254)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-254 advisory. - A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0....

Fortinet FortiWeb Log injection (FG-IR-23-256)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-256 advisory. - An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5...

VulnCheck KEV: CVE-2021-22122

An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack XSS by injecting malicious payload in different vulnerable API...

PT-2024-4056 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.4.2 and below FortiWeb versions 7.2.7 and below FortiWeb versions 7.0.10 and below FortiWeb versions 6.4.3 and below FortiWeb versions 6.3.23 and below Description: The issue is related to improper authorization...

The vulnerability of the command-line interface of the FortiMail email protection system, the FortiWeb web applications, and the Fortinet FortiNDR (Network Detection and Response) software – a hardware-based information protection solution using AI and deep neural networks – allows attackers to execute arbitrary GET requests.

The vulnerability of the command-line interface of the FortiMail email protection system, the FortiWeb web applications, and the Fortinet FortiNDR Network Detection and Response software-based information protection solution is related to the manipulation of cross-site requests. Exploiting this...

The vulnerability of FortiWeb web applications’ network firewalls arises from improper processing of output data for registration logs, allowing attackers to replace the traffic logs.

The vulnerability of FortiWeb web applications’ network firewalls is related to improper processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to replace traffic logs through a specially created web page...

CVE-2023-46713

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

CVE-2023-46713

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

Input validation

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

CVE-2023-46713

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

CVE-2023-46713

Fortinet FortiWeb is affected by CVE-2023-46713 due to improper output neutralization for logs, enabling forging of traffic logs via a crafted URL. Affected versions: 6.2.0–6.2.8, 6.3.0–6.3.23, 7.0.0–7.0.9, 7.2.0–7.2.5, and 7.4.0. Remediation per vendor sources: upgrade to a version outside these...