CVE-2023-34990

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-349919.8A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and CVE-2023-349929.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to eCVE-2023-349939.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-349944.3An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OACVE-2023-349959.8There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the CVE-2023-349977.8Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authCVE-2023-349988.1An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A speciaCVE-2023-349997.2A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attackerCVE-2023-35006.1An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 beforeCVE-2023-350017.8Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in anyCVE-2023-350029.8A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed fCVE-2023-350037.8Path transversal in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation o
CVE-2023-34990: Critical severity, CVSS 9.8 | Vulnix