CVE-2022-22297

EUVD-2022-27443 · Published Mar 7, 2023

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Technologies

Fortinet FortiwebFortinet Fortirecorder Firmware

Weaknesses

NVD-CWE-OtherCWE-792

CVSS scores

v3.15.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation

References

https://fortiguard.com/psirt/FG-IR-21-218

Potentially impacted assets

See if this affects your attack surface