description: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests.
problem types: Information disclosure
affected:
{
vendor: Fortinet
product: FortiWLM
defaultStatus: unaffected
versions:
versionType: semver, version: 8.6.0, lessThanOrEqual: 8.6.6, status: affected
versionType: semver, version: 8.5.0, lessThanOrEqual: 8.5.4, status: affected
versionType: semver, version: 8.4.0, lessThanOrEqual: 8.4.2, status: affected
versionType: semver, version: 8.3.0, lessThanOrEqual: 8.3.2, status: affected
version: 8.2.2, status: affected
}
metrics:
format: CVSS
cvssV3_1: [
version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:X
]
solutions: Please upgrade to FortiWLM version 8.6.6 or above
Please upgrade to FortiWLM version 8.5.5 or above