Improper input validation in custom dataset Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-432 Final 1 1 2023-04-11T00:00:00 Current version 2023-04-11T00:00:00 2023-04-11T00:00:00 An improper input validation vulnerability [CWE-20] in FortiAnalyzer & FortiManager may allow an authenticated attacker to disclose file system information via custom dataset SQL queries.Workaround:If enabled, disabled the FortiAnalyzer features option in FortiManager via:config system globalset faz-status disableendFortiManager 100C is not impacted due to the absence of FortiAnalyzer features option. None Information disclosure At leastFortiManager version 7.2.0 through 7.2.1FortiManager version 7.0.0 through 7.0.6FortiManager version 6.4.0 through 6.4.11FortiManager 6.2 all versionsFortiManager 6.0 all versionsAt leastFortiAnalyzer version 7.4.0 through 7.4.1FortiAnalyzer version 7.2.0 through 7.2.3FortiAnalyzer version 7.0.0 through 7.0.8FortiAnalyzer version 6.4.0 through 6.4.12FortiAnalyzer version 6.2.0 through 6.2.11FortiAnalyzer version 6.0.1 through 6.0.12 Please upgrade to upcoming FortiAnalyzer version 7.4.2 or abovePlease upgrade to FortiAnalyzer version 7.2.4 or abovePlease upgrade to FortiAnalyzer version 7.0.9 or abovePlease upgrade to FortiAnalyzer version 6.4.13 or abovePlease upgrade to FortiAnalyzer version 6.2.12 or abovePlease upgrade to upcoming FortiManager version 7.4.2 or abovePlease upgrade to FortiManager version 7.2.4 or abovePlease upgrade to FortiManager version 7.0.9 or abovePlease upgrade to FortiManager version 6.4.13 or abovePlease upgrade to FortiManager version 6.2.12 or above Fortinet is pleased to thank Darmin Blazevic (Fujitsu Services GmbH) for bringing this issue to our attention under responsible disclosure. FortiAnalyzer 7.4.1 FortiAnalyzer 7.4.0 FortiAnalyzer 7.2.3 FortiAnalyzer 7.2.2 FortiAnalyzer 7.2.1 FortiAnalyzer 7.2.0 FortiAnalyzer 7.0.8 FortiAnalyzer 7.0.7 FortiAnalyzer 7.0.6 FortiAnalyzer 7.0.5 FortiAnalyzer 7.0.4 FortiAnalyzer 7.0.3 FortiAnalyzer 7.0.2 FortiAnalyzer 7.0.1 FortiAnalyzer 7.0.0 FortiAnalyzer 6.4.12 FortiAnalyzer 6.4.11 FortiAnalyzer 6.4.10 FortiAnalyzer 6.4.9 FortiAnalyzer 6.4.8 FortiAnalyzer 6.4.7 FortiAnalyzer 6.4.6 FortiAnalyzer 6.4.5 FortiAnalyzer 6.4.4 FortiAnalyzer 6.4.3 FortiAnalyzer 6.4.2 FortiAnalyzer 6.4.1 FortiAnalyzer 6.4.0 FortiAnalyzer 6.2.11 FortiAnalyzer 6.2.10 FortiAnalyzer 6.2.9 FortiAnalyzer 6.2.8 FortiAnalyzer 6.2.7 FortiAnalyzer 6.2.6 FortiAnalyzer 6.2.5 FortiAnalyzer 6.2.4 FortiAnalyzer 6.2.3 FortiAnalyzer 6.2.2 FortiAnalyzer 6.2.1 FortiAnalyzer 6.2.0 FortiAnalyzer 6.0.12 FortiAnalyzer 6.0.11 FortiAnalyzer 6.0.10 FortiAnalyzer 6.0.9 FortiAnalyzer 6.0.8 FortiAnalyzer 6.0.7 FortiAnalyzer 6.0.6 FortiAnalyzer 6.0.5 FortiAnalyzer 6.0.4 FortiAnalyzer 6.0.3 FortiAnalyzer 6.0.2 FortiAnalyzer 6.0.1 FortiManager 7.2.1 FortiManager 7.2.0 FortiManager 7.0.6 FortiManager 7.0.5 FortiManager 7.0.4 FortiManager 7.0.3 FortiManager 7.0.2 FortiManager 7.0.1 FortiManager 7.0.0 FortiManager 6.4.11 FortiManager 6.4.10 FortiManager 6.4.9 FortiManager 6.4.8 FortiManager 6.4.7 FortiManager 6.4.6 FortiManager 6.4.5 FortiManager 6.4.4 FortiManager 6.4.3 FortiManager 6.4.2 FortiManager 6.4.1 FortiManager 6.4.0 FortiManager 6.2.13 FortiManager 6.2.12 FortiManager 6.2.11 FortiManager 6.2.10 FortiManager 6.2.9 FortiManager 6.2.8 FortiManager 6.2.7 FortiManager 6.2.6 FortiManager 6.2.5 FortiManager 6.2.4 FortiManager 6.2.3 FortiManager 6.2.2 FortiManager 6.2.1 FortiManager 6.2.0 FortiManager 6.0.12 FortiManager 6.0.11 FortiManager 6.0.10 FortiManager 6.0.9 FortiManager 6.0.8 FortiManager 6.0.7 FortiManager 6.0.6 FortiManager 6.0.5 FortiManager 6.0.4 FortiManager 6.0.3 FortiManager 6.0.2 FortiManager 6.0.1 FortiManager 6.0.0 CVE-2022-42477 FortiAnalyzer-7.4.1 FortiAnalyzer-7.4.0 FortiAnalyzer-7.2.3 FortiAnalyzer-7.2.2 FortiAnalyzer-7.2.1 FortiAnalyzer-7.2.0 FortiAnalyzer-7.0.8 FortiAnalyzer-7.0.7 FortiAnalyzer-7.0.6 FortiAnalyzer-7.0.5 FortiAnalyzer-7.0.4 FortiAnalyzer-7.0.3 FortiAnalyzer-7.0.2 FortiAnalyzer-7.0.1 FortiAnalyzer-7.0.0 FortiAnalyzer-6.4.12 FortiAnalyzer-6.4.11 FortiAnalyzer-6.4.10 FortiAnalyzer-6.4.9 FortiAnalyzer-6.4.8 FortiAnalyzer-6.4.7 FortiAnalyzer-6.4.6 FortiAnalyzer-6.4.5 FortiAnalyzer-6.4.4 FortiAnalyzer-6.4.3 FortiAnalyzer-6.4.2 FortiAnalyzer-6.4.1 FortiAnalyzer-6.4.0 FortiAnalyzer-6.2.11 FortiAnalyzer-6.2.10 FortiAnalyzer-6.2.9 FortiAnalyzer-6.2.8 FortiAnalyzer-6.2.7 FortiAnalyzer-6.2.6 FortiAnalyzer-6.2.5 FortiAnalyzer-6.2.4 FortiAnalyzer-6.2.3 FortiAnalyzer-6.2.2 FortiAnalyzer-6.2.1 FortiAnalyzer-6.2.0 FortiAnalyzer-6.0.12 FortiAnalyzer-6.0.11 FortiAnalyzer-6.0.10 FortiAnalyzer-6.0.9 FortiAnalyzer-6.0.8 FortiAnalyzer-6.0.7 FortiAnalyzer-6.0.6 FortiAnalyzer-6.0.5 FortiAnalyzer-6.0.4 FortiAnalyzer-6.0.3 FortiAnalyzer-6.0.2 FortiAnalyzer-6.0.1 FortiManager-7.2.1 FortiManager-7.2.0 FortiManager-7.0.6 FortiManager-7.0.5 FortiManager-7.0.4 FortiManager-7.0.3 FortiManager-7.0.2 FortiManager-7.0.1 FortiManager-7.0.0 FortiManager-6.4.11 FortiManager-6.4.10 FortiManager-6.4.9 FortiManager-6.4.8 FortiManager-6.4.7 FortiManager-6.4.6 FortiManager-6.4.5 FortiManager-6.4.4 FortiManager-6.4.3 FortiManager-6.4.2 FortiManager-6.4.1 FortiManager-6.4.0 FortiManager-6.2.13 FortiManager-6.2.12 FortiManager-6.2.11 FortiManager-6.2.10 FortiManager-6.2.9 FortiManager-6.2.8 FortiManager-6.2.7 FortiManager-6.2.6 FortiManager-6.2.5 FortiManager-6.2.4 FortiManager-6.2.3 FortiManager-6.2.2 FortiManager-6.2.1 FortiManager-6.2.0 FortiManager-6.0.12 FortiManager-6.0.11 FortiManager-6.0.10 FortiManager-6.0.9 FortiManager-6.0.8 FortiManager-6.0.7 FortiManager-6.0.6 FortiManager-6.0.5 FortiManager-6.0.4 FortiManager-6.0.3 FortiManager-6.0.2 FortiManager-6.0.1 FortiManager-6.0.0 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-22-432 Improper input validation in custom dataset Reference>