CVE-2020-29015 - A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement

Back Back to CVE browser

CRITICAL

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement

Published Jan 14, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 2.60%

Description

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

Affected products

Vendor n/a Product Fortinet FortiWeb Default
n/a
- Version
  FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4
  Status
  affected
  Constraints
  -