CVE-2020-29015

CRITICAL

FortiWeb < 6.2.4 and 6.3.0-6.3.7 - Unauthenticated Blind SQL Injection via Authorization Header

Title source: llm

Description

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.fortiguard.com/psirt/FG-IR-20-124

Scores

CVSS v3 9.8

EPSS 0.0100

EPSS Percentile 77.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

fortinet/fortiweb < 6.2.4

Published Jan 14, 2021

Tracked Since Feb 18, 2026