CVE-2023-22636CWE-285

An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker…

Medium · published February 27, 2023

CVSS v3.1
6.6
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-02-27T08:55Z
EPSS history
Timeline
  • 27 FEB 08:55Z
    An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker…
    cvelistv5