CVEvulnerability

CVE-2022-22297

5.5 MEDIUM Published 2023-03-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-792

Description

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Affected configurations

• fortinet fortiweb (>= 6.0.0 <= 6.0.8) • fortinet fortiweb (>= 6.1.0 <= 6.1.3) • fortinet fortiweb (>= 6.2.0 <= 6.2.7) • fortinet fortiweb (>= 6.3.0 <= 6.3.17) • fortinet fortiweb (>= 6.4.0 <= 6.4.3) • fortinet fortirecorder firmware (>= 2.7.0 <= 2.7.7) • fortinet fortirecorder firmware (>= 6.0.0 <= 6.0.12) • fortinet fortirecorder firmware (>= 6.4.0 <= 6.4.3)

Related

Weakness · CWE (1)

  • CWE-792 Incomplete Filtering of One or More Instances of Special Elements weakness

References