CVE-2023-23778 — Relative Path Traversal in Fortinet Fortiweb

CWE-23 — Relative Path TraversalCWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUMNVD
CNA4.9
EPSS
0.4%
top 37.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Fortinet Fortiweb
Timeline
PublishedFeb 16

Description

A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions, 6.2 all versions may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5fortinet/fortiweb7.0.0 — 7.0.1+3
▶NVDfortinet/fortiweb6.2.3 — 6.2.7+6

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2023-23778: A relative path traversal vulnerability [CWE-23] in FortiWeb version 7↗2023-02-16
▶
GHSA
GHSA-38r6-7w5c-g3hj: A relative path traversal vulnerability [CWE-23] in FortiWeb version 7↗2023-02-16
▶

📋Vendor Advisories

1
Fortinet
A relative path traversal vulnerability [CWE-23] in FortiWeb version 7.0.1 and below, 6.4 all versions, 6.3 all versions...↗2023-02-16
▶
CVE-2023-23778 — Relative Path Traversal in Fortinet | cvebase