Actively exploited · Published Mar 7, 2023 · Assigned by fortinet

CVE-2022-41328

Medium 6.5 Exploited

In plain English

A medium-severity path traversal in FortiOS from Fortinet. Attackers are actively exploiting it in the wild (listed by CISA on March 14, 2023). The chance it is exploited in the next 30 days is estimated at 10.7% (higher than 96% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)10.7%top 4.2% of all CVEs

Exploited in the wildYesCISA KEV since Mar 14, 2023

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 4, 2023.

Official description

A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

Affected products (as reported)

Vendor	Product	Versions
Fortinet	FortiOS	7.2.0 – through 7.2.37.0.0 – through 7.0.96.4.0 – through 6.4.116.2.0 – through 6.2.136.0.0 – through 6.0.16

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

In plain English

CISA guidance

Official description

Affected products (as reported)

References