NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2020-29015

CVSS 3.1: 9.8 critical
EPSS: 3%p84
Published: Jan 14, 2021 · Jan 14, 2021
Modified: Jun 17, 2026

Analyze CVE-2020-29015 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.

Vendors: fortinet

Products: fortiweb

Weakness: CWE-89

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news

5 stories

Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF

The Hacker NewsAug 19, 06:50 UTC · Aug 19, 2021VulnerabilityExploitedCVE-2021-22123 CVE-2020-29015 CVE-2018-13379+21 · 1 read

60

Flaws in FortiWeb WAF expose Fortinet devices to remote hack

Security AffairsJun 25, 12:55 UTC · Jun 25, 2021RansomwareCVE-2021-22123 CVE-2020-290152 · 1 read

60

Fortinet addresses 4 vulnerabilities in FortiWeb web application firewalls

Security AffairsFeb 5, 08:33 UTC · Feb 5, 2021VulnerabilityCVE-2020-29015 CVE-2020-29016 CVE-2020-29019+12 · 1 read

47

Fortinet FortiWeb OS Command Injection allows takeover servers remotely

Security AffairsAug 17, 15:31 UTC · Aug 17, 2021VulnerabilityCVE-2020-290152 · 1 read

35

Flaws in Fortinet FortiWeb WAF could allow corporate networks to hack

Security AffairsJan 7, 14:23 UTC · Jan 7, 2021VulnerabilityCVE-2020-29015 CVE-2020-29016 CVE-2020-29018+13 · 2 reads

35