CVE-2022-22297
Description
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiweb | 6.0.0 ≤ v ≤ 6.0.8, 6.1.0 ≤ v ≤ 6.1.3, 6.2.0 ≤ v ≤ 6.2.7, 6.3.0 ≤ v ≤ 6.3.17, 6.4.0 ≤ v ≤ 6.4.3 | — |
| fortinet fortirecorder_firmware | 2.7.0 ≤ v ≤ 2.7.7, 6.0.0 ≤ v ≤ 6.0.12, 6.4.0 ≤ v ≤ 6.4.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.