CVE-2023-42791

A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests.

Affected

Fortinet · FortiManager · FortiAnalyzer

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

3.99% chance of exploitation in the next 30 days, 90th percentile

Published

2024-02-20

Updated

2024-08-02

Proof-of-concept exploits (1)

• synacktiv/CVE-2023-42791_CVE-2024-236666★ · 2025-02-12

Security advisories

• https://fortiguard.com/psirt/FG-IR-23-189

References

• CVE Record
• NVD entry

Related

• CVE-2018-6789
• CVE-2019-15846
• CVE-2019-8942
• CVE-2020-27950
• CVE-2020-9289
• CVE-2021-1782