Riskcovery

CVE-2022-41328

State
Published
Severity
6.5 Medium
Published
Mar 7, 2023
Updated
Oct 21, 2025
Reserved
Sep 23, 2022

Read the record on cve.org

Description

A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:Cfortinet

Weaknesses

  • CWE-22 Execute unauthorized code or commands

Affected Products

ProductVersions
FortiOSFortinet
  • 7.2.0 through 7.2.3Affected
  • 7.0.0 through 7.0.9Affected
  • 6.4.0 through 6.4.11Affected
  • 6.2.0 through 6.2.13Affected
  • 6.0.0 through 6.0.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.