CVE-2020-29018

HIGH

FortiWeb 6.3.0-6.3.5 - Authenticated Format String Injection via Redir Parameter

Title source: llm
STIX 2.1

Description

A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.fortiguard.com/psirt/FG-IR-20-123

Scores

CVSS v3 8.8
EPSS 0.0203
EPSS Percentile 78.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-134
Status published
Products (1)
fortinet/fortiweb 6.3.0 - 6.3.5
Published Jan 14, 2021
Tracked Since Feb 18, 2026