CVE-2022-30302

Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 1.0.0 through 4.0.1

Description The issue is related to relative path traversal errors in the management interface, allowing a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests. This can be achieved by sending crafted web requests to vulnerable API endpoints, such as /api/v1/files, to access or modify files outside the intended directory. The filename variable can be manipulated to traverse directories and access sensitive data.

Recommendations For FortiDeceptor versions 1.0.0 through 3.2.x, update to a version outside of this range to mitigate the risk. For FortiDeceptor versions 3.3.0 through 3.3.2, update to a version outside of this range to mitigate the risk. For FortiDeceptor versions 4.0.0 through 4.0.1, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.