CVE-2022-41335

Summary

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiSwitchManager7.2.0affected
FortinetFortiSwitchManager7.0.0affected
FortinetFortiOS7.2.0 <= 7.2.2affected
FortinetFortiOS7.0.0 <= 7.0.8affected
FortinetFortiOS6.4.0 <= 6.4.11affected
FortinetFortiOS6.2.0 <= 6.2.12affected
FortinetFortiProxy7.2.0 <= 7.2.1affected
FortinetFortiProxy7.0.0 <= 7.0.7affected
FortinetFortiProxy2.0.0 <= 2.0.11affected
FortinetFortiProxy1.2.0 <= 1.2.13affected
FortinetFortiProxy1.1.0 <= 1.1.6affected
FortinetFortiProxy1.2.0 < 1.2.*affected
FortinetFortiProxy1.1.0 < 1.1.*affected
FortinetFortiProxy1.0.0 < 1.0.*affected

Weaknesses

  • CWE-23: Execute unauthorized code or commands

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References