CVE-2022-30299 - A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests

Back Back to CVE browser

MEDIUM

A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests

Published Feb 16, 2023

5.0

MEDIUM

CVSS 3.1

EPSS 0.47%

Description

A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests.

Affected products

Vendor Fortinet Product FortiWeb Default
unaffected
- Version
  6.0.0
  Status
  affected
  Constraints
  <=6.0.8
- Version
  6.1.0
  Status
  affected
  Constraints
  <=6.1.3
- Version
  6.2.0
  Status
  affected
  Constraints
  <=6.2.7
- Version
  6.3.0
  Status
  affected
  Constraints
  <=6.3.19
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.2
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.1