NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

CVE-2020-29018

CVSS 3.1: 8.8 high
EPSS: 2%p80
Published: Jan 14, 2021 · Jan 14, 2021
Modified: Jun 17, 2026

Analyze CVE-2020-29018 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.

Vendors: fortinet

Products: fortiweb

Weakness: CWE-134

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news

2 stories

Fortinet addresses 4 vulnerabilities in FortiWeb web application firewalls

Security AffairsFeb 5, 08:33 UTC · Feb 5, 2021VulnerabilityCVE-2020-29015 CVE-2020-29016 CVE-2020-29019+12 · 1 read

47

Flaws in Fortinet FortiWeb WAF could allow corporate networks to hack

Security AffairsJan 7, 14:23 UTC · Jan 7, 2021VulnerabilityCVE-2020-29015 CVE-2020-29016 CVE-2020-29018+13 · 2 reads

35