CVE-2022-30300: Path Traversal
Published Feb 16, 2023
·Updated
A relative path traversal vulnerability [CWE-23] in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests.
Affected Software
6 affected components
Fortinet FortiWeb>=6.3.6<6.3.19
Fortinet FortiWeb=6.4.0
Fortinet FortiWeb=6.4.1
Fortinet FortiWeb=6.4.2
Fortinet FortiWeb=7.0.0
Fortinet FortiWeb=7.0.1
Remediation
Patch Available
Information
Upgrade FortiWeb to version 7.0.2 and above.
Upgrade FortiWeb to version 6.3.19 and above.
Event History
Feb 16, 2023
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this relative path traversal vulnerability in FortiWeb?
The vulnerability ID is CVE-2022-30300.
2
What is the severity rating of CVE-2022-30300?
The severity rating of CVE-2022-30300 is medium (6.5).
3
Which versions of FortiWeb are affected by CVE-2022-30300?
FortiWeb versions 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, and 6.4.0 through 6.4.2 are affected by CVE-2022-30300.
4
How can an attacker exploit CVE-2022-30300?
An authenticated attacker can exploit CVE-2022-30300 by sending specifically crafted HTTP GET requests to obtain unauthorized access to files and data.
5
Is there a fix available for CVE-2022-30300?
Yes, it is recommended to update FortiWeb to a version that is not affected by CVE-2022-30300.