Path traversal vulnerability in administrative interface

Path traversal vulnerability in administrative interface Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-393 Final 1 1 2023-06-12T00:00:00 Current version 2023-06-12T00:00:00 2023-06-12T00:00:00 A relative path traversal vulnerability [CWE-23] in FortiOS, FortiProxy & FortiSwitchManager administrative interface may allow a privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests. None Execute unauthorized code or commands FortiSwitchManager version 7.2.0 through 7.2.1FortiSwitchManager version 7.0.0 through 7.0.1FortiProxy version 7.2.0 through 7.2.1FortiProxy version 7.0.0 through 7.0.7FortiProxy version 2.0.0 through 2.0.11FortiProxy 1.2 all versionsFortiProxy 1.1 all versionsFortiProxy 1.0 all versionsFortiOS 7.4 all versions are not affectedFortiOS version 7.2.0 through 7.2.3FortiOS version 7.0.0 through 7.0.9FortiOS version 6.4.0 through 6.4.12FortiOS 6.2 all versions Please upgrade to FortiOS version 7.4.0 or abovePlease upgrade to FortiOS version 7.2.4 or abovePlease upgrade to FortiOS version 7.0.10 or abovePlease upgrade to FortiOS version 6.4.13 or abovePlease upgrade to FortiSwitchManager version 7.2.2 or abovePlease upgrade to FortiSwitchManager version 7.0.2 or abovePlease upgrade to FortiProxy version 7.2.2 or abovePlease upgrade to FortiProxy version 7.0.8 or abovePlease upgrade to FortiProxy version 2.0.12 or above Internally discovered and reported by Théo Leleu of Fortinet Product Security team. FortiOS 7.2.3 FortiOS 7.2.2 FortiOS 7.2.1 FortiOS 7.2.0 FortiOS 7.0.9 FortiOS 7.0.8 FortiOS 7.0.7 FortiOS 7.0.6 FortiOS 7.0.5 FortiOS 7.0.4 FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.12 FortiOS 6.4.11 FortiOS 6.4.10 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiOS 6.2.17 FortiOS 6.2.16 FortiOS 6.2.15 FortiOS 6.2.14 FortiOS 6.2.13 FortiOS 6.2.12 FortiOS 6.2.11 FortiOS 6.2.10 FortiOS 6.2.9 FortiOS 6.2.8 FortiOS 6.2.7 FortiOS 6.2.6 FortiOS 6.2.5 FortiOS 6.2.4 FortiOS 6.2.3 FortiOS 6.2.2 FortiOS 6.2.1 FortiOS 6.2.0 FortiProxy 7.2.1 FortiProxy 7.2.0 FortiProxy 7.0.7 FortiProxy 7.0.6 FortiProxy 7.0.5 FortiProxy 7.0.4 FortiProxy 7.0.3 FortiProxy 7.0.2 FortiProxy 7.0.1 FortiProxy 7.0.0 FortiProxy 2.0.11 FortiProxy 2.0.10 FortiProxy 2.0.9 FortiProxy 2.0.8 FortiProxy 2.0.7 FortiProxy 2.0.6 FortiProxy 2.0.5 FortiProxy 2.0.4 FortiProxy 2.0.3 FortiProxy 2.0.2 FortiProxy 2.0.1 FortiProxy 2.0.0 FortiProxy 1.2.13 FortiProxy 1.2.12 FortiProxy 1.2.11 FortiProxy 1.2.10 FortiProxy 1.2.9 FortiProxy 1.2.8 FortiProxy 1.2.7 FortiProxy 1.2.6 FortiProxy 1.2.5 FortiProxy 1.2.4 FortiProxy 1.2.3 FortiProxy 1.2.2 FortiProxy 1.2.1 FortiProxy 1.2.0 FortiProxy 1.1.6 FortiProxy 1.1.5 FortiProxy 1.1.4 FortiProxy 1.1.3 FortiProxy 1.1.2 FortiProxy 1.1.1 FortiProxy 1.1.0 FortiProxy 1.0.7 FortiProxy 1.0.6 FortiProxy 1.0.5 FortiProxy 1.0.4 FortiProxy 1.0.3 FortiProxy 1.0.2 FortiProxy 1.0.1 FortiProxy 1.0.0 FortiSwitchManager 7.2.1 FortiSwitchManager 7.2.0 FortiSwitchManager 7.0.1 FortiSwitchManager 7.0.0 Path traversal vulnerability in administrative interface CVE-2022-42474 FortiOS-7.2.3 FortiOS-7.2.2 FortiOS-7.2.1 FortiOS-7.2.0 FortiOS-7.0.9 FortiOS-7.0.8 FortiOS-7.0.7 FortiOS-7.0.6 FortiOS-7.0.5 FortiOS-7.0.4 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.12 FortiOS-6.4.11 FortiOS-6.4.10 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiOS-6.2.17 FortiOS-6.2.16 FortiOS-6.2.15 FortiOS-6.2.14 FortiOS-6.2.13 FortiOS-6.2.12 FortiOS-6.2.11 FortiOS-6.2.10 FortiOS-6.2.9 FortiOS-6.2.8 FortiOS-6.2.7 FortiOS-6.2.6 FortiOS-6.2.5 FortiOS-6.2.4 FortiOS-6.2.3 FortiOS-6.2.2 FortiOS-6.2.1 FortiOS-6.2.0 FortiProxy-7.2.1 FortiProxy-7.2.0 FortiProxy-7.0.7 FortiProxy-7.0.6 FortiProxy-7.0.5 FortiProxy-7.0.4 FortiProxy-7.0.3 FortiProxy-7.0.2 FortiProxy-7.0.1 FortiProxy-7.0.0 FortiProxy-2.0.11 FortiProxy-2.0.10 FortiProxy-2.0.9 FortiProxy-2.0.8 FortiProxy-2.0.7 FortiProxy-2.0.6 FortiProxy-2.0.5 FortiProxy-2.0.4 FortiProxy-2.0.3 FortiProxy-2.0.2 FortiProxy-2.0.1 FortiProxy-2.0.0 FortiProxy-1.2.13 FortiProxy-1.2.12 FortiProxy-1.2.11 FortiProxy-1.2.10 FortiProxy-1.2.9 FortiProxy-1.2.8 FortiProxy-1.2.7 FortiProxy-1.2.6 FortiProxy-1.2.5 FortiProxy-1.2.4 FortiProxy-1.2.3 FortiProxy-1.2.2 FortiProxy-1.2.1 FortiProxy-1.2.0 FortiProxy-1.1.6 FortiProxy-1.1.5 FortiProxy-1.1.4 FortiProxy-1.1.3 FortiProxy-1.1.2 FortiProxy-1.1.1 FortiProxy-1.1.0 FortiProxy-1.0.7 FortiProxy-1.0.6 FortiProxy-1.0.5 FortiProxy-1.0.4 FortiProxy-1.0.3 FortiProxy-1.0.2 FortiProxy-1.0.1 FortiProxy-1.0.0 FortiSwitchManager-7.2.1 FortiSwitchManager-7.2.0 FortiSwitchManager-7.0.1 FortiSwitchManager-7.0.0 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-22-393 Path traversal vulnerability in administrative interface Reference>