CVE-2022-29059 - Vulnerability Details - OpenCVE

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://fortiguard.com/psirt/FG-IR-22-140

History

Fri, 14 Mar 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 14 Mar 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters.
Weaknesses		CWE-89
References		https://fortiguard.com/psirt/FG-IR-22-140
Metrics		cvssV3_1 `{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2025-03-14T15:45:33.731Z

Updated: 2025-03-14T17:52:08.746Z

Reserved: 2022-04-11T13:56:39.870Z

Link: CVE-2022-29059

Vulnrichment

Updated: 2025-03-14T17:51:58.837Z

NVD

Status : Received

Published: 2025-03-14T16:15:27.027

Modified: 2025-03-14T16:15:27.027

Link: CVE-2022-29059

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-29059", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2022-04-11T13:56:39.870Z", "datePublished": "2025-03-14T15:45:33.731Z", "dateUpdated": "2025-03-14T17:52:08.746Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiWeb", "cpes": [], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.1", "status": "affected"}, {"versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.3", "status": "affected"}, {"versionType": "semver", "version": "6.3.0", "lessThanOrEqual": "6.3.23", "status": "affected"}, {"versionType": "semver", "version": "6.2.3", "lessThanOrEqual": "6.2.8", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an SQL command\u00a0('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-03-14T15:45:33.731Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiWeb version 7.0.2 or above."}], "references": [{"name": "https://fortiguard.com/psirt/FG-IR-22-140", "url": "https://fortiguard.com/psirt/FG-IR-22-140"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-14T17:49:57.286454Z", "id": "CVE-2022-29059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T17:52:08.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-29059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-14T17:49:57.286454Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T17:51:58.837Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": [], "vendor": "Fortinet", "product": "FortiWeb", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.1"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.3"}, {"status": "affected", "version": "6.3.0", "versionType": "semver", "lessThanOrEqual": "6.3.23"}, {"status": "affected", "version": "6.2.3", "versionType": "semver", "lessThanOrEqual": "6.2.8"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiWeb version 7.0.2 or above."}], "references": [{"url": "https://fortiguard.com/psirt/FG-IR-22-140", "name": "https://fortiguard.com/psirt/FG-IR-22-140"}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an SQL command\u00a0('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-03-14T15:45:33.731Z"}}}, "cveMetadata": {"cveId": "CVE-2022-29059", "state": "PUBLISHED", "dateUpdated": "2025-03-14T17:52:08.746Z", "dateReserved": "2022-04-11T13:56:39.870Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2025-03-14T15:45:33.731Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}