Vulnerability · Published Jan 14, 2021 · Assigned by fortinet
CVE-2020-29015
Critical 9.8
In plain English
A critical-severity security flaw in Fortinet FortiWeb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.6%top 14.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Fortinet FortiWeb | FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 |
References
- https://www.fortiguard.com/psirt/FG-IR-20-124 x_refsource_MISC