virus logo PSIRT

FortiWeb - Double free in pipe management

Summary

A double free vulnerability (CWE-415) in FortiWeb CLI may allow an authenticated, local attacker to achieve arbitrary code execution via specifically crafted commands

Version Affected Solution
FortiWeb 7.2 Not affected Not Applicable
FortiWeb 7.0 7.0.0 through 7.0.3 Upgrade to 7.0.4 or above

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.
IR Number FG-IR-22-348
Date Feb 16, 2023
Severity High
CVSSv3 Score 7.1
Impact Execute unauthorized code or commands
CVE ID CVE-2022-40683
CVRF Download