CVE-2022-42477

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.6 FortiAnalyzer version 6.4

Description The issue is related to improper input validation, which may allow an authenticated attacker to disclose file system information via custom SQL queries to a dataset. This can potentially reveal sensitive information about the file system.

Recommendations For FortiManager and FortiAnalyzer versions prior to 7.2.1, update to a version that includes the fix for this issue. For FortiAnalyzer versions prior to 7.0.6, update to a version that includes the fix for this issue. For FortiAnalyzer version 6.4, consider disabling custom dataset SQL queries until a patch is available.