CVE-2023-25606

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions may allow a remote and authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Fortinet	FortiManager	>= 7.2.0, <= 7.2.1; >= 7.0.0, <= 7.0.5; >= 6.4.0, <= 6.4.10
Fortinet	FortiAnalyzer	>= 7.2.0, <= 7.2.1; >= 7.0.0, <= 7.0.5; >= 6.4.0, <= 6.4.10

References

https://fortiguard.com/psirt/FG-IR-22-471Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-471Vendor Advisory

Timeline

Published: Jul 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-256077.8An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 CVE-2023-256086.5An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7 CVE-2023-256096.5A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6,CVE-2023-25614.3The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove CVE-2023-256109.8A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, vers CVE-2023-256117.3A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 CVE-2023-256139.8An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3.CVE-2023-256146.1SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unaut CVE-2023-256154.9Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user CVE-2023-256168.8In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code i CVE-2023-256178.8SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects e CVE-2023-256186.5SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791,