A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.
References
| Link | Resource |
|---|---|
| https://fortiguard.com/advisory/FG-IR-21-181 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Dec 2021, 19:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:* |
|
| References | (CONFIRM) https://fortiguard.com/advisory/FG-IR-21-181 - Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-22 |
08 Dec 2021, 13:21
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-12-08 13:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-41024
Mitre link : CVE-2021-41024
CVE.ORG link : CVE-2021-41024
JSON object : View
Products Affected
fortinet
- fortiproxy
- fortios
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')