CVE-2023-42791

Summary

A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiManager7.4.0affected
FortinetFortiManager7.2.0 <= 7.2.3affected
FortinetFortiManager7.0.0 <= 7.0.8affected
FortinetFortiManager6.4.0 <= 6.4.12affected
FortinetFortiManager6.2.0 <= 6.2.11affected
FortinetFortiAnalyzer7.4.0affected
FortinetFortiAnalyzer7.2.0 <= 7.2.3affected
FortinetFortiAnalyzer7.0.0 <= 7.0.8affected
FortinetFortiAnalyzer6.4.0 <= 6.4.12affected
FortinetFortiAnalyzer6.2.0 <= 6.2.11affected

Weaknesses

  • CWE-23: Execute unauthorized code or commands

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

CVE Program Container

Additional References

References