An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system silently via crafted CLI requests.
Weakness
The product does not properly “clean up” and remove temporary or supporting resources after they have been used.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fortiproxy | Fortinet | 1.1.0 (including) | 7.0.9 (excluding) |
| Fortiproxy | Fortinet | 7.2.0 (including) | 7.2.3 (excluding) |