CVE-2022-30300 — Relative Path Traversal in Fortinet Fortiweb

CWE-23 — Relative Path TraversalCWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 35.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedFeb 16

Description

A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDfortinet/fortiweb6.3.6 — 6.3.19+5
▶CVEListV5fortinet/fortiweb7.0.0 — 7.0.1+2

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4wrr-wx49-f3mw: A relative path traversal vulnerability [CWE-23] in FortiWeb 7↗2023-02-16
▶
CVEList
CVE-2022-30300: A relative path traversal vulnerability [CWE-23] in FortiWeb 7↗2023-02-16
▶

📋Vendor Advisories

1
Fortinet
A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions...↗2023-02-16
▶
CVE-2022-30300 — Relative Path Traversal in Fortinet | cvebase