CVE-2022-22297
First published: Tue Mar 07 2023(Updated: )
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiWeb | >=6.0.0<=6.0.8 | |
| Fortinet FortiWeb | >=6.1.0<=6.1.3 | |
| Fortinet FortiWeb | >=6.2.0<=6.2.7 | |
| Fortinet FortiWeb | >=6.3.0<=6.3.17 | |
| Fortinet FortiWeb | >=6.4.0<=6.4.3 | |
| Fortinet Fortirecorder Firmware | >=2.7.0<=2.7.7 | |
| Fortinet Fortirecorder Firmware | >=6.0.0<=6.0.12 | |
| Fortinet Fortirecorder Firmware | >=6.4.0<=6.4.3 |
Remedy
Upgrade to FortiWeb version 7.0.0 or above, Upgrade to FortiWeb version 6.4.2 or above. Upgrade to FortiWeb version 6.3.18 or above. Upgrade to FortiRecorder version 7.0.0 or above Upgrade to FortiRecorder version 6.4.4 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-22297?
CVE-2022-22297 is a vulnerability in the command line interpreter of FortiWeb versions 6.0.0 through 6.4.1, FortiRecorder Firmware versions 2.7.0 through 6.4.3.
How does CVE-2022-22297 affect FortiWeb?
CVE-2022-22297 affects FortiWeb versions 6.0.0 through 6.4.1, allowing for incomplete filtering of special elements in the command line interpreter.
What is the severity of CVE-2022-22297?
The severity of CVE-2022-22297 is medium, with a severity value of 5.5.
How can I fix CVE-2022-22297?
To fix CVE-2022-22297, it is recommended to update FortiWeb to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2022-22297?
More information about CVE-2022-22297 can be found at the FortiGuard website: https://fortiguard.com/psirt/FG-IR-21-218
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/fortinet
- canonical/fortinet fortiweb
- version/fortinet fortiweb/6.0.0
- version/fortinet fortiweb/6.0.8
- version/fortinet fortiweb/6.1.0
- version/fortinet fortiweb/6.1.3
- version/fortinet fortiweb/6.2.0
- version/fortinet fortiweb/6.2.7
- version/fortinet fortiweb/6.3.0
- version/fortinet fortiweb/6.3.17
- version/fortinet fortiweb/6.4.0
- version/fortinet fortiweb/6.4.3
- canonical/fortinet fortirecorder firmware
- version/fortinet fortirecorder firmware/2.7.0
- version/fortinet fortirecorder firmware/2.7.7
- version/fortinet fortirecorder firmware/6.0.0
- version/fortinet fortirecorder firmware/6.0.12
- version/fortinet fortirecorder firmware/6.4.0
- version/fortinet fortirecorder firmware/6.4.3