Fortinet FortiOS 7.0.x < 7.0.2 Path Traversal (FG-IR-21-181)

high Nessus Plugin ID 158390


The remote host is affected by a path traversal vulnerability.


The remote host is running a version of FortiOS that is 7.0.x prior to 7.0.2. It is, therefore, affected by a path traversal vulnerability that may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


See vendor advisory.

See Also

Plugin Details

Severity: High

ID: 158390

File Name: fortios_FG-IR-21-181.nasl

Version: 1.2

Type: local

Family: Firewalls

Published: 2/25/2022

Updated: 2/28/2022

Risk Information


Risk Factor: Low

Score: 3.6


Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS Score Source: CVE-2021-41024


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Required KB Items: Host/Fortigate/version

Exploit Ease: No known exploits are available

Patch Publication Date: 12/7/2021

Vulnerability Publication Date: 12/7/2021

Reference Information

CVE: CVE-2021-41024

IAVA: 2021-A-0574