CVE-2022-41328
CVSS v3
7.1
HIGH
EPSS Score
0.2 %
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
Description
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
CISA Known Exploited Vulnerability
- Date Added
- 2023-03-14
- Patch Due Date
- 2023-04-04
- Ransomware Use
- Unknown
Technical details
- Published
- 2023-03-07
Frequently asked questions
What is CVE-2022-41328?
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
Is CVE-2022-41328 actively exploited?
Yes. CVE-2022-41328 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2023-04-04.
What is the CVSS score for CVE-2022-41328?
CVE-2022-41328 has a CVSS v3 base score of 7.1 (HIGH severity).
Is CVE-2022-41328 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2022 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).