Paper/Archive/CVE-2020-29015

CVE-2020-29015

fortinet — A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote…

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 85.5.855 × 2017.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

Affected

ProductAffectedFixed inSource

Fortinet FortiWebFortiWeb 6.3.0 through 6.3.7 and version before 6.2.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-20-124