Details of VAR-202307-1027

ID

VAR-202307-1027

CVE

CVE-2022-23447

TITLE

Fortinet FortiExtender Path traversal vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202307-793

DESCRIPTION

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests

Trust: 0.99

sources: NVD: CVE-2022-23447 // VULMON: CVE-2022-23447

AFFECTED PRODUCTS

vendor:	fortinet	model:	fortiextender	scope:	lt	version:	7.0.4	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.0.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	4.1.9	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	3.2.4	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.2.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	3.3.3	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	3.3.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	4.0.3	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	eq	version:	5.3.2	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	3.2.1	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	lt	version:	4.2.5	Trust: 1.0
vendor:	fortinet	model:	fortiextender	scope:	gte	version:	4.1.1	Trust: 1.0

sources: NVD: CVE-2022-23447

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-23447
value:	HIGH
Trust: 1.0
psirt@fortinet.com:	CVE-2022-23447
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202307-793
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-23447
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0

sources: CNNVD: CNNVD-202307-793 // NVD: CVE-2022-23447 // NVD: CVE-2022-23447

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.0

sources: NVD: CVE-2022-23447

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202307-793

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202307-793

PATCH

title:

Fortinet FortiExtender Repair measures for path traversal vulnerabilities

url:

http://123.124.177.30/web/xxk/bdxqById.tag?id=246954

Trust: 0.6

sources: CNNVD: CNNVD-202307-793

EXTERNAL IDS

db:	NVD	id:	CVE-2022-23447	Trust: 1.7
db:	CNNVD	id:	CNNVD-202307-793	Trust: 0.6
db:	VULMON	id:	CVE-2022-23447	Trust: 0.1

sources: VULMON: CVE-2022-23447 // CNNVD: CNNVD-202307-793 // NVD: CVE-2022-23447

REFERENCES

url:	https://fortiguard.com/psirt/fg-ir-22-039	Trust: 1.7
url:	https://cxsecurity.com/cveshow/cve-2022-23447/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2022-23447 // CNNVD: CNNVD-202307-793 // NVD: CVE-2022-23447

SOURCES

db:	VULMON	id:	CVE-2022-23447
db:	CNNVD	id:	CNNVD-202307-793
db:	NVD	id:	CVE-2022-23447

LAST UPDATE DATE

2024-08-14T14:54:38.818000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-23447	date:	2023-07-12T00:00:00
db:	CNNVD	id:	CNNVD-202307-793	date:	2023-07-21T00:00:00
db:	NVD	id:	CVE-2022-23447	date:	2023-11-07T03:44:09.007

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-23447	date:	2023-07-11T00:00:00
db:	CNNVD	id:	CNNVD-202307-793	date:	2023-07-11T00:00:00
db:	NVD	id:	CVE-2022-23447	date:	2023-07-11T17:15:10.383