Vulnerability Details : CVE-2022-22297
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.
Products affected by CVE-2022-22297
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
- cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
- Fortinet » Fortirecorder FirmwareVersions from including (>=) 2.7.0 and up to, including, (<=) 2.7.7cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:*
- Fortinet » Fortirecorder FirmwareVersions from including (>=) 6.0.0 and up to, including, (<=) 6.0.12cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:*
- Fortinet » Fortirecorder FirmwareVersions from including (>=) 6.4.0 and up to, including, (<=) 6.4.3cpe:2.3:o:fortinet:fortirecorder_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-22297
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 7 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-22297
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
Fortinet, Inc. |
References for CVE-2022-22297
-
https://fortiguard.com/psirt/FG-IR-21-218
PSIRT Advisories | FortiGuardVendor Advisory
Jump to