FG-IR-24-474: Directory Traversal
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-474?
The severity of FG-IR-24-474 is considered high due to the potential for unauthorized filesystem access.
How do I fix FG-IR-24-474?
To fix FG-IR-24-474, upgrade FortiWeb to version 7.6.3 or later, or 7.4.7 or later, depending on your current version.
Who is affected by FG-IR-24-474?
FG-IR-24-474 affects administrators using FortiWeb versions 7.6.2 and earlier for 7.6, 7.4.6 and earlier for 7.4, and all versions from 7.2 and 7.0.
What type of vulnerability is FG-IR-24-474?
FG-IR-24-474 is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability.
Can FG-IR-24-474 be exploited remotely?
Yes, FG-IR-24-474 can potentially be exploited remotely by authenticated administrators through crafted requests.