IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.5Media KEV

CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability

Fortinet FortiOS Publicada: (hace 3 años)

Explotación conocida — Fortinet FortiOS Path Traversal Vulnerability

CISA confirmó el 14.03.2023 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 04.04.2023.

Acción requerida: Apply updates per vendor instructions. https://www.fortiguard.com/psirt/FG-IR-22-369; https://nvd.nist.gov/vuln/detail/CVE-2022-41328

Descripción

A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

Debilidad (CWE): CWE-22

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Fortinet FortiOS 7.2.0 – ≤ 7.2.3, 7.0.0 – ≤ 7.0.9, 6.4.0 – ≤ 6.4.11, 6.2.0 – ≤ 6.2.13, 6.0.0 – ≤ 6.0.16

Referencias y parches

Coincidencias CPE (NVD) (5)
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.16
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.14
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.12
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.10
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.4

CVE recientes del mismo producto — Fortinet (all products)

6.7Media
CVE-2026-106174
Fortinet FortiOS

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

9.6Crítica
CVE-2026-107656
Fortinet FortiSandbox; Fortinet FortiSandbox PaaS

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions,…

2.1Baja
CVE-2026-106175
Fortinet FortiOS; Fortinet FortiSwitch; Fortinet FortiProxy

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions…

4.9Media
CVE-2026-106172
Fortinet FortiSandbox; Fortinet FortiSandbox Cloud

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Clo…

7.9Alta
CVE-2025-46773
Fortinet FortiAnalyzer Cloud; Fortinet FortiAnalyzer

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud …

6.5Media
CVE-2026-23705
Fortinet FortiAnalyzer; Fortinet FortiManager

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.13, FortiManager 7.4…