Exploit público

Arbitrary file write and delete in JSON API

CVSSv3 Score: 7.3 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer API may allow an authenticated attacker whose profile only has read permission to write and delete files from the underlying filesystem via crafted HTTP or HTTPs requests. Revised on 2026-11-10 00:00:00

Este es el aviso número 71 de Fortinet PSIRT en pwned.cl.

CategoríaFortinet PSIRT

Fuente: Fortinet PSIRT