CVE-2022-42477 - An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries

Back Back to CVE browser

MEDIUM

An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries

Published Apr 11, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authenticated attacker to disclose file system information via custom dataset SQL queries.

Affected products

Vendor Fortinet Product FortiAnalyzer Default
unaffected
- Version
  6.4.0
  Status
  affected
  Constraints
  <=6.4.10
- Version
  7.0.0
  Status
  affected
  Constraints
  <=7.0.6
- Version
  7.2.0
  Status
  affected
  Constraints
  <=7.2.1