Fortinet FortiManager and FortiManager Cloud Path Traversal Vulnerability Allowing Arbitrary File Overwrite

A path traversal vulnerability has been identified in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, and below 7.0.13, as well as FortiManager Cloud versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, and 7.2.1 through 7.2.9. This vulnerability allows an authenticated remote attacker to overwrite arbitrary files by sending crafted FGFM requests.

Impact

Exploitation of this vulnerability allows for arbitrary file overwriting on the affected system.

Remediation

Users can upgrade Fortinet FortiManager to version 7.6.2 or above, 7.4.6 or above, 7.2.10 or above, or 7.0.14 or above, depending on their current version. Fortinet FortiManager Cloud users should upgrade to version 7.4.6 or above, 7.2.10 or above, or migrate to a fixed release, depending on their current version.