virus logo PSIRT

Unauthenticated arbitrary file read vulnerability

Summary

A relative path traversal vulnerability [CWE-23] in FortiWLM may allow a remote unauthenticated attacker to read arbitrary files via crafted HTTP requests.

Version Affected Solution
FortiWLM 8.6 8.6.0 through 8.6.5 Upgrade to 8.6.6 or above
FortiWLM 8.5 8.5.0 through 8.5.4 Upgrade to 8.5.5 or above
FortiWLM 8.4 8.4 all versions Migrate to a fixed release
FortiWLM 8.3 8.3 all versions Migrate to a fixed release
FortiWLM 8.2 8.2 all versions Migrate to a fixed release

Acknowledgement

Fortinet is pleased to thank security researchers Zach Hanley (@hacks_zach) of Horizon3.ai for discovering and reporting this vulnerability under responsible disclosure.
IR Number FG-IR-23-143
Published Date Nov 14, 2023
Severity High
CVSSv3 Score 7.3
Impact Information disclosure
CVE ID CVE-2023-42783
CVRF Download