Lucene search

[email protected]NVD:CVE-2022-42474

HistoryJun 13, 2023 - 9:15 a.m.

CVE-2022-42474

2023-06-1309:15:15

CWE-23

CWE-22

[email protected]

web.nvd.nist.gov

fortinet

relative path traversal

filesystem deletion

CVSS3

2.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

30.1%

JSON

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.7, FortiSwitchManager version 7.2.0 through 7.2.1 and before 7.0.1 allows an privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests.

Affected configurations

Nvd

Node

fortinetfortiproxyRange1.0.0–1.0.7

fortinetfortiproxyRange1.1.0–1.1.6

fortinetfortiproxyRange1.2.0–1.2.13

fortinetfortiproxyRange2.0.0–2.0.11

fortinetfortiproxyRange7.0.0–7.0.7

fortinetfortiproxyMatch7.2.0

fortinetfortiproxyMatch7.2.1

fortinetfortiswitchmanagerMatch7.0.0

fortinetfortiswitchmanagerMatch7.0.1

fortinetfortiswitchmanagerMatch7.2.0

fortinetfortiswitchmanagerMatch7.2.1

fortinetfortiosRange6.2.0–6.2.15

fortinetfortiosRange6.4.0–6.4.12

fortinetfortiosRange7.0.0–7.0.9

fortinetfortiosRange7.2.0–7.2.3

VendorProductVersionCPE
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy7.2.0cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
fortinetfortiproxy7.2.1cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
fortinetfortiswitchmanager7.0.0cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*
fortinetfortiswitchmanager7.0.1cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:*:*:*:*:*:*:*
fortinetfortiswitchmanager7.2.0cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*
fortinetfortiswitchmanager7.2.1cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	7.2.0	cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::*
fortinet	fortiproxy	7.2.1	cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::*
fortinet	fortiswitchmanager	7.0.0	cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:::::::*
fortinet	fortiswitchmanager	7.0.1	cpe:2.3:a:fortinet:fortiswitchmanager:7.0.1:::::::*
fortinet	fortiswitchmanager	7.2.0	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:::::::*
fortinet	fortiswitchmanager	7.2.1	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.1:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::