An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and below 7.2.5 & FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker to read arbitrary files from the underlying system via crafted HTTP or HTTPs requests.
2024-11-12T19:15:09.073
2025-01-21T22:19:39.353
Analyzed
CVSSv3.1: 4.9 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | fortinet | fortianalyzer | < 7.2.6 | Yes |
| Application | fortinet | fortianalyzer | < 7.4.3 | Yes |
| Application | fortinet | fortianalyzer_big_data | < 7.2.8 | Yes |
| Application | fortinet | fortianalyzer_big_data | 7.4.0 | Yes |
| Application | fortinet | fortimanager | < 7.2.6 | Yes |
| Application | fortinet | fortimanager | < 7.4.3 | Yes |