CVE-2022-30306: Buffer Overflow
Published Feb 16, 2023
·Updated
A stack-based buffer overflow vulnerability [CWE-121] in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password.
Affected Software
6 affected components
Fortinet FortiWeb>=6.3.6<6.3.20
Fortinet FortiWeb=6.4.0
Fortinet FortiWeb=6.4.1
Fortinet FortiWeb=6.4.2
Fortinet FortiWeb=7.0.0
Fortinet FortiWeb=7.0.1
Remediation
Patch Available
Information
Please upgrade to FortiWeb version 7.0.2 or above
Please upgrade to FortiWeb version 6.3.20 or above
Event History
Feb 16, 2023
CVE Published
via MITRE·06:06 PM
Data Sourced
via MITRE·06:06 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-30306.
2
What is the severity of CVE-2022-30306?
The severity of CVE-2022-30306 is high with a CVSS score of 8.8.
3
What is the affected software?
The affected software is Fortinet FortiWeb versions 6.3.6 to 6.3.20, 6.4.0 to 6.4.2, and 7.0.0 to 7.0.1.
4
How does CVE-2022-30306 vulnerability occur?
The vulnerability occurs in the CA sign functionality of FortiWeb and is caused by a stack-based buffer overflow.
5
How can an attacker exploit CVE-2022-30306?
An authenticated attacker can exploit CVE-2022-30306 by using a specifically crafted password to achieve arbitrary code execution.