MEDIUM🇵🇱 Wersja polska

CVE-2022-22297

CVSS 5.5v3.1pub. 2023-03-07upd. 2024-11-21

An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Fortinet Fortirecorder Firmware

    OS
    Fortinet
    2.7.0 – 2.7.76.0.0 – 6.0.126.4.0 – 6.4.3

  • Fortinet Fortiweb

    APP
    Fortinet
    6.3.0 – 6.3.176.0.0 – 6.0.86.4.0 – 6.4.36.1.0 – 6.1.36.2.0 – 6.2.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-24858CRITICAL9.8⚠ KEVPL ✓same product

Fortinet – Auth Bypass przez FortiCloud SSO w wielu produktach

CVE-2025-64446CRITICAL9.8⚠ KEVPL ✓same product

Path Traversal w Fortinet FortiWeb umożliwiający zdalne wykonanie poleceń

CVE-2025-25257CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność SQL Injection w Fortinet FortiWeb — obejście uwierzytelnienia

CVE-2025-59719CRITICAL9.8PL ✓same product

Fortinet FortiWeb — pominięcie uwierzytelnienia SSO przez spreparowany SAML

CVE-2023-25610CRITICAL9.8PL ✓same product

Buffer Underflow w interfejsie administracyjnym Fortinet FortiOS / FortiProxy — RCE bez uwierzytelnienia