CVE-2023-25606CWE-22

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management…

Medium · published July 11, 2023

CVSS v3.1
6.2
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4  all versions may allow a remote and authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C
CVSS v4.0
Not supplied
EPSS
0.00554 · 45.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-07-11T16:52Z
EPSS history
Timeline
  • 11 JUL 16:52Z
    An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management…
    cvelistv5