CVE-2022-29059

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.1 and below FortiWeb versions 6.4.2 and below FortiWeb versions 6.3.20 and below FortiWeb versions 6.2.7 and below

Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This may allow a privileged attacker to execute SQL commands over the log database via specifically crafted string parameters.

Recommendations: For FortiWeb versions 7.0.1 and below, update to a version above 7.0.1 to resolve the issue. For FortiWeb versions 6.4.2 and below, update to a version above 6.4.2 to resolve the issue. For FortiWeb versions 6.3.20 and below, update to a version above 6.3.20 to resolve the issue. For FortiWeb versions 6.2.7 and below, update to a version above 6.2.7 to resolve the issue. As a temporary workaround, consider restricting access to the log database to minimize the risk of exploitation.