CVE-2022-23447CWE-22
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through…
High · published July 11, 2023
What it is
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.
The record
Technical detail
- CVSS v3.1
- 7.3 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:U/RC:C
- CVSS v4.0
- Not supplied
- EPSS
- 0.00799 · 56.1th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2023-07-11T16:52Z
EPSS history
Timeline