Fortinet FortiWeb Relative Path Traversal Vulnerability Allowing Arbitrary File Read

A relative path traversal vulnerability has been identified in Fortinet FortiWeb versions 7.6.0 to 7.6.4, 7.4.0 to 7.4.8, 7.2.0 to 7.2.11, and 7.0.2 to 7.0.11. This vulnerability may allow an authenticated attacker to read arbitrary files on the underlying system by sending crafted requests.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure by allowing an authenticated attacker to read arbitrary files from the system.

Remediation

Users can upgrade to FortiWeb 7.6.5 or above, FortiWeb 7.4.9 or above, FortiWeb 7.2.12 or above. For FortiWeb 7.0, users should migrate to a fixed release.