Fortinet FortiWeb - Unauthorized Configuration Download (FG-IR-22-460)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-460 advisory. - An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through...

CVE-2023-22636

An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request...

CVE-2023-22636

CVE-2023-22636 affects FortiWeb with unauthorized configuration download via a crafted HTTP request. Affected versions: FortiWeb 6.3.6–6.3.21, 6.4.0–6.4.2, and 7.0.0–7.0.4. Root cause: potential insufficient access control on configuration files. Impact: local attacker could access confidential c...