The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-146 advisory. A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests. (CVE-2022-30299) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version…Read More
Fortinet FortiWeb – Relative path traversal in web API (FG-IR-22-146)
