« Back to list

CVE-2022-30302

Status: ModifiedHigh (8.1)—

Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Fortinet — Fortideceptor

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-30302",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-30302",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-22T20:19:23.572081Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "Fortinet FortiDeceptor",
          "versions": [
            {
              "status": "affected",
              "version": "FortiDeceptor 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-19T14:15:08.820",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-21-213",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-21-213",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de ruta relativo [CWE-23] en la interfaz de administración de FortiDeceptor versiones 1.0.0 hasta 3.2.x, 3.3.0 hasta 3.3.2, 4.0.0 hasta 4.0.1, pueden permitir a un atacante remoto y autenticado recuperar y eliminar archivos arbitrarios del sistema de archivos subyacente por medio de peticiones web especialmente diseñadas."
    }
  ],
  "lastModified": "2026-06-17T04:43:26.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14DEDA0E-12BB-4407-8B3F-F0ED56623189",
              "versionEndIncluding": "3.2.2",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortideceptor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C59892D-BD8D-4BED-8729-370B52905898",
              "versionEndIncluding": "3.3.2",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortideceptor:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD223A7A-54CD-4509-BB34-CD0F68F901D0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortideceptor:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19ADEB6B-EAED-4EA3-80BB-06E194F312F8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}