CVE-2022-33871

6.3MEDIUM

Key Information:

Vendor
Fortinet
Status
Fortiweb
Vendor
CVE Published:
16 February 2023

Summary

A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and earlier, 6.4 all versions, version 6.3.19 and earlier may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI execute backup-local rename and execute backup-local show operations.

Affected Version(s)

FortiWeb 7.0.0 <= 7.0.1

FortiWeb 6.4.0 <= 6.4.2

FortiWeb 6.3.6 <= 6.3.19

References

https://fortiguard.com/psirt/FG-IR-22-164

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.