Common Weakness Enumeration
CWE-792
AllowedIncomplete Filtering of One or More Instances of Special Elements
Abstraction: Variant · Status: Incomplete
The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
8 vulnerabilities reference this CWE, most recent first.
GCVE-1988-2026-0230
Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 10:07
VLAI
EPSS
VEX
Title
CVE-2025-12758: Unicode Variation Selectors Bypass in 'validator' library (isLength)
Summary
Summary
=======
A vulnerability was discovered in the popular JavaScript library
'validator'.
The isLength() function incorrectly handles Unicode Variation Selectors
(U+FE0E and U+FE0F). An attacker can inject thousands of these zero-width
characters into a string, causing the library to report a much smaller
perceived length than the actual byte size. This leads to validation
bypasses,
potential database truncation, and Denial of Service (DoS).
Metadata
========
CVE ID: CVE-2025-12758
Vulnerability Type: Incomplete Filtering of Special Elements (CWE-792)
Affected Package: validator (npm)
Affected Versions: < 13.15.22
Fixed Version: 13.15.22
CVSS Score: 7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Description
===========
The 'validator' library's isLength() method is widely used to enforce
constraints on input data. However, the implementation failed to account
for
Unicode Variation Selectors. These are zero-width code points that modify
the
presentation of the preceding character (e.g., changing a text character
into
an emoji).
Because these characters have zero width but occupy bytes in memory (UTF-16
surrogate pairs or single code points depending on the environment), an
attacker can craft a payload that:
1. Appears to have a length of 1 (e.g., 'a' followed by 5000 variation
selectors).
2. isLength() reports it as length 1 or 2 (depending on internal logic).
3. The actual memory/storage size is massive (e.g., 10,000+ bytes).
Impact
======
- Denial of Service (DoS): Sending extremely large payloads that pass
length
checks can exhaust server memory or CPU during processing.
- Data Truncation: Databases with strict byte limits (e.g., VARCHAR(255))
may truncate the string, potentially leading to data corruption or
application logic errors.
- Security Bypass: Bypassing UI or API limits intended to prevent large
blobs of data.
Proof of Concept (PoC)
======================
const validator = require('validator');
// 'a' followed by many Variation Selector-16 (\uFE0F)
const payload = 'a' + '\uFE0F'.repeat(5000);
console.log("Actual length (chars):", payload.length); // 5001
console.log("Validator isLength(payload, {max: 5}):",
validator.isLength(payload, {max: 5}));
// In vulnerable versions, this returns 'true' because selectors
// were not properly counted or were ignored in a way that bypassed
// the total length check.
Fix
===
The issue was fixed in version 13.15.22 by implementing a surgical fix
that correctly identifies and counts valid Unicode pairs and variation
selectors, ensuring the reported length matches the actual data footprint
more accurately.
Timeline
========
- 2025-10-18: Vulnerability reported to maintainers by Karol Wrótniak.
- 2025-11-27: CVE-2025-12758 published.
- 2025-11-09: Fixed version 13.15.22 released.
References
==========
[1] https://www.thedroidsonroids.com/blog/when-zero-width-isnt-zero
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-12758
[3] https://github.com/validatorjs/validator.js/releases/tag/13.15.22
--
*Karol Wrótniak *
Senior Android Developer
*/*
[image: Logo]
www.droidsonroids.com <https://www.thedroidsonroids.com/>
Wrocław, ul. Sikorskiego 26, 53-659 Poland
[image: Clutch Profile] <https://clutch.co/profile/droids-roids> [image:
Dribbble Profile] <https://dribbble.com/DroidsOnRoids> [image: Behance
Profile] <https://www.behance.net/droidsonroids> [image: Instagram Profile]
<https://www.instagram.com/droidsonroidsmobile/> [image: Github Profile]
<https://github.com/DroidsOnRoids> [image: X Profile]
<https://twitter.com/droidsonroids> [image: Facebook Profile]
<https://www.facebook.com/droidsonroids> [image: Linkedin Profile]
<https://pl.linkedin.com/company/droids-on-roids?trk=public_profile_topcard-current-company>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
16 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cve | CVE-2025-12758 Unicode Variation |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0230 (this record)
- related CVE-2025-12758
{
"containers": {
"cna": {
"affected": [
{
"product": "CVE-2025-12758 Unicode Variation",
"vendor": "Cve",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Karol Wr\u00f3tniak"
}
],
"descriptions": [
{
"lang": "en",
"value": "Summary\n=======\nA vulnerability was discovered in the popular JavaScript library\n\u0027validator\u0027.\nThe isLength() function incorrectly handles Unicode Variation Selectors\n(U+FE0E and U+FE0F). An attacker can inject thousands of these zero-width\ncharacters into a string, causing the library to report a much smaller\nperceived length than the actual byte size. This leads to validation\nbypasses,\npotential database truncation, and Denial of Service (DoS).\n\nMetadata\n========\nCVE ID: CVE-2025-12758\nVulnerability Type: Incomplete Filtering of Special Elements (CWE-792)\nAffected Package: validator (npm)\nAffected Versions: \u003c 13.15.22\nFixed Version: 13.15.22\nCVSS Score: 7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nDescription\n===========\nThe \u0027validator\u0027 library\u0027s isLength() method is widely used to enforce\nconstraints on input data. However, the implementation failed to account\nfor\nUnicode Variation Selectors. These are zero-width code points that modify\nthe\npresentation of the preceding character (e.g., changing a text character\ninto\nan emoji).\n\nBecause these characters have zero width but occupy bytes in memory (UTF-16\nsurrogate pairs or single code points depending on the environment), an\nattacker can craft a payload that:\n1. Appears to have a length of 1 (e.g., \u0027a\u0027 followed by 5000 variation\nselectors).\n2. isLength() reports it as length 1 or 2 (depending on internal logic).\n3. The actual memory/storage size is massive (e.g., 10,000+ bytes).\n\nImpact\n======\n- Denial of Service (DoS): Sending extremely large payloads that pass\nlength\n checks can exhaust server memory or CPU during processing.\n- Data Truncation: Databases with strict byte limits (e.g., VARCHAR(255))\n may truncate the string, potentially leading to data corruption or\n application logic errors.\n- Security Bypass: Bypassing UI or API limits intended to prevent large\n blobs of data.\n\nProof of Concept (PoC)\n======================\nconst validator = require(\u0027validator\u0027);\n\n// \u0027a\u0027 followed by many Variation Selector-16 (\\uFE0F)\nconst payload = \u0027a\u0027 + \u0027\\uFE0F\u0027.repeat(5000);\n\nconsole.log(\"Actual length (chars):\", payload.length); // 5001\nconsole.log(\"Validator isLength(payload, {max: 5}):\",\n validator.isLength(payload, {max: 5}));\n\n// In vulnerable versions, this returns \u0027true\u0027 because selectors\n// were not properly counted or were ignored in a way that bypassed\n// the total length check.\n\nFix\n===\nThe issue was fixed in version 13.15.22 by implementing a surgical fix\nthat correctly identifies and counts valid Unicode pairs and variation\nselectors, ensuring the reported length matches the actual data footprint\nmore accurately.\n\nTimeline\n========\n- 2025-10-18: Vulnerability reported to maintainers by Karol Wr\u00f3tniak.\n- 2025-11-27: CVE-2025-12758 published.\n- 2025-11-09: Fixed version 13.15.22 released.\n\nReferences\n==========\n[1] https://www.thedroidsonroids.com/blog/when-zero-width-isnt-zero\n[2] https://nvd.nist.gov/vuln/detail/CVE-2025-12758\n[3] https://github.com/validatorjs/validator.js/releases/tag/13.15.22\n\n-- \n*Karol Wr\u00f3tniak *\nSenior Android Developer\n\n*/*\n[image: Logo]\n\nwww.droidsonroids.com \u003chttps://www.thedroidsonroids.com/\u003e\nWroc\u0142aw, ul. Sikorskiego 26, 53-659 Poland\n\n[image: Clutch Profile] \u003chttps://clutch.co/profile/droids-roids\u003e [image:\nDribbble Profile] \u003chttps://dribbble.com/DroidsOnRoids\u003e [image: Behance\nProfile] \u003chttps://www.behance.net/droidsonroids\u003e [image: Instagram Profile]\n\u003chttps://www.instagram.com/droidsonroidsmobile/\u003e [image: Github Profile]\n\u003chttps://github.com/DroidsOnRoids\u003e [image: X Profile]\n\u003chttps://twitter.com/droidsonroids\u003e [image: Facebook Profile]\n\u003chttps://www.facebook.com/droidsonroids\u003e [image: Linkedin Profile]\n\u003chttps://pl.linkedin.com/company/droids-on-roids?trk=public_profile_topcard-current-company\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-792",
"description": "CWE-792",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:07:08Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/27"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jan/27"
},
{
"url": "https://clutch.co/profile/droids-roids"
},
{
"url": "https://dribbble.com/DroidsOnRoids"
},
{
"url": "https://github.com/DroidsOnRoids"
},
{
"url": "https://github.com/validatorjs/validator.js/releases/tag/13.15.22"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12758"
},
{
"url": "https://pl.linkedin.com/company/droids-on-roids?trk=public_profile_topcard-current-company"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://twitter.com/droidsonroids"
},
{
"url": "https://www.behance.net/droidsonroids"
},
{
"url": "https://www.facebook.com/droidsonroids"
},
{
"url": "https://www.instagram.com/droidsonroidsmobile/"
},
{
"url": "https://www.thedroidsonroids.com/"
},
{
"url": "https://www.thedroidsonroids.com/blog/when-zero-width-isnt-zero"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jan/27"
],
"discovery": "EXTERNAL"
},
"title": "CVE-2025-12758: Unicode Variation Selectors Bypass in \u0027validator\u0027 library (isLength)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-12758",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0230",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/27",
"automated": true,
"contentSha256": "3f811160419685e23714b714c4bc76a905be3ad2cebf526de9f1b9e8a9f41764",
"evidenceScore": 11,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/27",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-01-28T18:24:40Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0230"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:43Z",
"dateUpdated": "2026-09-09T10:07:08Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0230"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-47779 (GCVE-0-2025-47779)
Vulnerability from cvelistv5 – Published: 2025-05-22 16:54 – Updated: 2025-11-03 20:04
VLAI
EPSS
VEX
Title
Using malformed From header can forge identity with ";" or NULL in name portion
Summary
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue.
Severity
7.7 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-22 17:25 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/asterisk/asterisk/security/adv… | x_refsource_CONFIRM |
| https://github.com/asterisk/asterisk/blob/master/… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-47779",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T17:25:58.891881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T17:26:57.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:04:36.858Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00003.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "asterisk",
"vendor": "asterisk",
"versions": [
{
"status": "affected",
"version": "\u003c 18.9-cert14"
},
{
"status": "affected",
"version": "\u003e= 18.10, \u003c 18.26.2"
},
{
"status": "affected",
"version": "\u003e= 20.0, \u003c 20.7-cert5"
},
{
"status": "affected",
"version": "\u003e= 20.8, \u003c 20.14.1"
},
{
"status": "affected",
"version": "\u003e= 21.0, \u003c 21.9.1"
},
{
"status": "affected",
"version": "\u003e= 22.0, \u003c 22.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-140",
"description": "CWE-140: Improper Neutralization of Delimiters",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-792",
"description": "CWE-792: Incomplete Filtering of One or More Instances of Special Elements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T16:54:26.314Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw"
},
{
"name": "https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample"
}
],
"source": {
"advisory": "GHSA-2grh-7mhv-fcfw",
"discovery": "UNKNOWN"
},
"title": "Using malformed From header can forge identity with \";\" or NULL in name portion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-47779",
"datePublished": "2025-05-22T16:54:26.314Z",
"dateReserved": "2025-05-09T19:49:35.620Z",
"dateUpdated": "2025-11-03T20:04:36.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-25608 (GCVE-0-2023-25608)
Vulnerability from cvelistv5 – Published: 2023-09-13 12:28 – Updated: 2024-09-24 20:00
VLAI
EPSS
VEX
Summary
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-24 19:45 UTC
CWE
- CWE-792 - Information disclosure
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiAP-W2 |
Affected:
7.2.0 , ≤ 7.2.1
(semver)
Affected: 7.0.3 , ≤ 7.0.5 (semver) Affected: 7.0.0 , ≤ 7.0.1 (semver) Affected: 6.4.0 , ≤ 6.4.9 (semver) Affected: 6.2.0 , ≤ 6.2.6 (semver) Affected: 6.0.0 , ≤ 6.0.6 (semver) |
|
| Fortinet | FortiAP-C |
Affected:
5.4.0 , ≤ 5.4.4
(semver)
Affected: 5.2.0 , ≤ 5.2.1 (semver) |
|
| Fortinet | FortiAP |
Affected:
7.2.0 , ≤ 7.2.1
(semver)
Affected: 7.0.0 , ≤ 7.0.5 (semver) Affected: 6.4.3 , ≤ 6.4.9 (semver) Affected: 6.0.0 , ≤ 6.0.6 (semver) |
|
| Fortinet | FortiAP-U |
Affected:
7.0.0
Affected: 6.2.0 , ≤ 6.2.5 (semver) Affected: 6.0.0 , ≤ 6.0.4 (semver) Affected: 5.4.3 , ≤ 5.4.6 (semver) Affected: 5.4.0 |
|
| Fortinet | FortiAP-S |
Affected:
6.4.0 , ≤ 6.4.9
(semver)
Affected: 6.2.0 , ≤ 6.2.6 (semver) Affected: 6.0.0 , ≤ 6.0.6 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:25:19.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-22-120",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-22-120"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25608",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T19:45:36.151614Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T20:00:10.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FortiAP-W2",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.5",
"status": "affected",
"version": "7.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.1",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.9",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.6",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiAP-C",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "5.4.4",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.1",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiAP",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.1",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.5",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.9",
"status": "affected",
"version": "6.4.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiAP-U",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.0.0"
},
{
"lessThanOrEqual": "6.2.5",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.6",
"status": "affected",
"version": "5.4.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiAP-S",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "6.4.9",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.6",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.6",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-792",
"description": "Information disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-13T12:28:51.497Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-22-120",
"url": "https://fortiguard.com/psirt/FG-IR-22-120"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiAP-W2 version 7.2.2 or above Please upgrade to FortiAP-W2 version 7.0.6 or above Please upgrade to FortiAP-C version 5.4.5 or above Please upgrade to FortiAP version 7.2.2 or above Please upgrade to FortiAP version 7.0.6 or above Please upgrade to FortiAP-U version 7.0.1 or above Please upgrade to FortiAP-U version 6.2.6 or above "
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2023-25608",
"datePublished": "2023-09-13T12:28:51.497Z",
"dateReserved": "2023-02-08T13:42:03.367Z",
"dateUpdated": "2024-09-24T20:00:10.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-20057 (GCVE-0-2023-20057)
Vulnerability from cvelistv5 – Published: 2023-01-19 01:32 – Updated: 2024-08-02 08:57
VLAI
EPSS
VEX
Summary
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device.
This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Severity
CWE
- CWE-792 - Incomplete Filtering of One or More Instances of Special Elements
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Email Security Appliance (ESA) |
Unaffected:
10.0.1-087
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:57:35.557Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cisco-sa-esa-url-bypass-WbMQqNJh",
"tags": [
"x_transferred"
],
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cisco Email Security Appliance (ESA)",
"vendor": "Cisco",
"versions": [
{
"status": "unaffected",
"version": "10.0.1-087"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device.\r\n\r This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 0,
"baseSeverity": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N",
"version": "3.1"
},
"format": "cvssV3_1"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-792",
"description": "Incomplete Filtering of One or More Instances of Special Elements",
"lang": "en",
"type": "cwe"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-15T00:27:54.327Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "cisco-sa-esa-url-bypass-WbMQqNJh",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh"
}
],
"source": {
"advisory": "cisco-sa-esa-url-bypass-WbMQqNJh",
"defects": [
"CSCwb58117"
],
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2023-20057",
"datePublished": "2023-01-19T01:32:32.802Z",
"dateReserved": "2022-10-27T18:47:50.320Z",
"dateUpdated": "2024-08-02T08:57:35.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-22297 (GCVE-0-2022-22297)
Vulnerability from cvelistv5 – Published: 2023-03-07 16:04 – Updated: 2024-10-22 20:48
VLAI
EPSS
VEX
Summary
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 20:18 UTC
CWE
- CWE-792 - Information disclosure
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiRecorder |
Affected:
6.4.0 , ≤ 6.4.3
(semver)
Affected: 6.0.0 , ≤ 6.0.12 (semver) Affected: 2.7.0 , ≤ 2.7.7 (semver) |
|
| Fortinet | FortiWeb |
Affected:
6.4.0 , ≤ 6.4.1
(semver)
Affected: 6.3.0 , ≤ 6.3.17 (semver) Affected: 6.2.0 , ≤ 6.2.7 (semver) Affected: 6.1.0 , ≤ 6.1.3 (semver) Affected: 6.0.0 , ≤ 6.0.8 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:07:50.182Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-21-218",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-21-218"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-22297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T20:18:25.909669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T20:48:26.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FortiRecorder",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "6.4.3",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.12",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.7.7",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiWeb",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "6.4.1",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.17",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.7",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.3",
"status": "affected",
"version": "6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.8",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-792",
"description": "Information disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-03-07T16:04:48.484Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-21-218",
"url": "https://fortiguard.com/psirt/FG-IR-21-218"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiWeb version 7.0.0 or above,\r\nUpgrade to FortiWeb version 6.4.2 or above.\r\nUpgrade to FortiWeb version 6.3.18 or above.\r\nUpgrade to FortiRecorder version 7.0.0 or above\r\nUpgrade to FortiRecorder version 6.4.4 or above\n\u00a0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2022-22297",
"datePublished": "2023-03-07T16:04:48.484Z",
"dateReserved": "2022-01-03T09:39:36.527Z",
"dateUpdated": "2024-10-22T20:48:26.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-6M4G-JHP3-F6R4
Vulnerability from github – Published: 2023-09-13 15:31 – Updated: 2024-04-04 07:38
VLAI
Details
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-25608"
],
"database_specific": {
"cwe_ids": [
"CWE-792"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-13T13:15:08Z",
"severity": "MODERATE"
},
"details": "An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments.",
"id": "GHSA-6m4g-jhp3-f6r4",
"modified": "2024-04-04T07:38:59Z",
"published": "2023-09-13T15:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25608"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-22-120"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-72VC-2HJP-VR3J
Vulnerability from github – Published: 2023-01-20 09:30 – Updated: 2023-01-30 21:30
VLAI
Details
A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-20057"
],
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-792"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-20T07:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass the URL reputation filters on an affected device. This vulnerability is due to improper processing of URLs. An attacker could exploit this vulnerability by crafting a URL in a particular way. A successful exploit could allow the attacker to bypass the URL reputation filters that are configured for an affected device, which could allow malicious URLs to pass through the device.",
"id": "GHSA-72vc-2hjp-vr3j",
"modified": "2023-01-30T21:30:20Z",
"published": "2023-01-20T09:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20057"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-url-bypass-WbMQqNJh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VGHF-HV5Q-VC2G
Vulnerability from github – Published: 2025-11-27 06:31 – Updated: 2026-01-31 03:33
VLAI
Summary
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
Details
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "validator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.15.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12758"
],
"database_specific": {
"cwe_ids": [
"CWE-172",
"CWE-792"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-02T16:51:42Z",
"nvd_published_at": "2025-11-27T05:16:12Z",
"severity": "HIGH"
},
"details": "Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.",
"id": "GHSA-vghf-hv5q-vc2g",
"modified": "2026-01-31T03:33:13Z",
"published": "2025-11-27T06:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12758"
},
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/pull/2616"
},
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382"
},
{
"type": "WEB",
"url": "https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e"
},
{
"type": "PACKAGE",
"url": "https://github.com/validatorjs/validator.js"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2026/Jan/27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.