CVE-2022-23447

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an unauthenticated and remote attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234487.8A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-234497.3A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-23457.8Use After Free in GitHub repository vim/vim prior to 9.0.0046.CVE-2022-234509.8A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-234518.1An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user t CVE-2022-234524.9An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. T CVE-2022-234537.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234547.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234557.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234565.5Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-234579.8ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the de CVE-2022-234586.1Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting