CVE-2022-22297

Description

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Reserved 2022-01-03 | Published 2023-03-07 | Updated 2024-10-22 | Assigner fortinet

Problem types

Information disclosure

Product status

Default status
unaffected

6.4.0
affected

6.0.0
affected

2.7.0
affected

Default status
unaffected

6.4.0
affected

6.3.0
affected

6.2.0
affected

6.1.0
affected

6.0.0
affected

References

fortiguard.com/psirt/FG-IR-21-218

cve.org (CVE-2022-22297)

nvd.nist.gov (CVE-2022-22297)

Download JSON