CVE-2022-22297CWE-792

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through…

Medium · published March 7, 2023

CVSS v3.1
5.2
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-792 · Incomplete Filtering of One or More Instances of Special Elements
Published
2023-03-07T16:04Z
EPSS history
Timeline
  • 07 MAR 16:04Z
    An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through…
    cvelistv5