Lucene search

[email protected]NVD:CVE-2022-41335

HistoryFeb 16, 2023 - 7:15 p.m.

CVE-2022-41335

2023-02-1619:15:13

CWE-23

CWE-22

[email protected]

web.nvd.nist.gov

fortinet fortios

fortiproxy

path traversal vulnerability

http requests

authenticated attacker

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

48.3%

JSON

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.

Affected configurations

Nvd

Node

fortinetfortiswitchmanagerMatch7.0.0

fortinetfortiswitchmanagerMatch7.2.0

Node

fortinetfortiproxyRange1.1.0–1.1.6

fortinetfortiproxyRange1.2.0–1.2.13

fortinetfortiproxyRange2.0.0–2.0.10

fortinetfortiproxyRange7.0.0–7.0.7

fortinetfortiproxyMatch7.2.0

fortinetfortiproxyMatch7.2.1

Node

fortinetfortiosRange6.2.0–6.2.12

fortinetfortiosRange6.4.0–6.4.10

fortinetfortiosRange7.0.0–7.0.8

fortinetfortiosMatch7.2.0

fortinetfortiosMatch7.2.1

fortinetfortiosMatch7.2.2

VendorProductVersionCPE
fortinetfortiswitchmanager7.0.0cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*
fortinetfortiswitchmanager7.2.0cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy7.2.0cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
fortinetfortiproxy7.2.1cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
fortinetfortios7.2.0cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*
fortinetfortios7.2.1cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*
fortinetfortios7.2.2cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiswitchmanager	7.0.0	cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:::::::*
fortinet	fortiswitchmanager	7.2.0	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:::::::*
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	7.2.0	cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::*
fortinet	fortiproxy	7.2.1	cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::
fortinet	fortios	7.2.0	cpe:2.3:o:fortinet:fortios:7.2.0:::::::*
fortinet	fortios	7.2.1	cpe:2.3:o:fortinet:fortios:7.2.1:::::::*
fortinet	fortios	7.2.2	cpe:2.3:o:fortinet:fortios:7.2.2:::::::*