CVE-2022-22297

Published: Mar 7, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

Affected (8)

Products: Fortinet: Fortirecorder Firmware, Fortiweb

Fortinet

2 products

Fortirecorder Firmware

Fortiweb

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortirecorder Firmware	From 2.7.0 to 2.7.7
Fortinet Fortirecorder Firmware	From 6.0.0 to 6.0.12
Fortinet Fortirecorder Firmware	From 6.4.0 to 6.4.3
Fortinet Fortiweb	From 6.0.0 to 6.0.8
Fortinet Fortiweb	From 6.1.0 to 6.1.3
Fortinet Fortiweb	From 6.2.0 to 6.2.7
Fortinet Fortiweb	From 6.3.0 to 6.3.17
Fortinet Fortiweb	From 6.4.0 to 6.4.3

Related CWEs

CWE-792

Incomplete Filtering of One or More Instances of Special Elements

The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.

References (2)

https://fortiguard.com/psirt/FG-IR-21-218

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-21-218

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.