Lucene search

FortinetCVE-2022-27488

HistoryDec 13, 2023 - 7:15 a.m.

CVE-2022-27488

2023-12-1307:15:10

CWE-352

fortinet

web.nvd.nist.gov

cve-2022-27488

csrf

fortinet

fortivoiceenterprise

fortiswitch

fortimail

fortirecorder

fortindr

security vulnerability

command execution

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.

Affected configurations

Nvd

Node

fortinetfortiaiMatch1.1.0

fortinetfortiaiMatch1.5.3

fortinetfortimailRange6.0.0–6.0.12

fortinetfortimailRange6.2.0–6.2.9

fortinetfortimailRange6.4.0–6.4.6

fortinetfortimailRange7.0.0–7.0.3

fortinetfortindrRange7.0.0–7.0.4

fortinetfortindrMatch7.1.0

fortinetfortirecorderRange2.6.0–2.6.3

fortinetfortirecorderRange2.7.0–2.7.7

fortinetfortirecorderRange6.0.0–6.0.11

fortinetfortirecorderRange6.4.0–6.4.2

fortinetfortivoiceRange6.0.0–6.0.11

fortinetfortivoiceRange6.4.0–6.4.7

fortinetfortiswitchRange6.0.0–6.0.7

fortinetfortiswitchRange6.2.0–6.2.7

fortinetfortiswitchRange6.4.0–6.4.10

fortinetfortiswitchRange7.0.0–7.0.4

VendorProductVersionCPE
fortinetfortiai1.1.0cpe:2.3:a:fortinet:fortiai:1.1.0:*:*:*:*:*:*:*
fortinetfortiai1.5.3cpe:2.3:a:fortinet:fortiai:1.5.3:*:*:*:*:*:*:*
fortinetfortimail*cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
fortinetfortindr*cpe:2.3:a:fortinet:fortindr:*:*:*:*:*:*:*:*
fortinetfortindr7.1.0cpe:2.3:a:fortinet:fortindr:7.1.0:*:*:*:*:*:*:*
fortinetfortirecorder*cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*
fortinetfortivoice*cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*
fortinetfortiswitch*cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiai	1.1.0	cpe:2.3:a:fortinet:fortiai:1.1.0:::::::*
fortinet	fortiai	1.5.3	cpe:2.3:a:fortinet:fortiai:1.5.3:::::::*
fortinet	fortimail	*	cpe:2.3:a:fortinet:fortimail::::::::
fortinet	fortindr	*	cpe:2.3:a:fortinet:fortindr::::::::
fortinet	fortindr	7.1.0	cpe:2.3:a:fortinet:fortindr:7.1.0:::::::*
fortinet	fortirecorder	*	cpe:2.3:a:fortinet:fortirecorder::::::::
fortinet	fortivoice	*	cpe:2.3:a:fortinet:fortivoice::::::::
fortinet	fortiswitch	*	cpe:2.3:o:fortinet:fortiswitch::::::::

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiVoice",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.11",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiRecorder",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.2",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.7.0",
        "lessThanOrEqual": "2.7.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.6.0",
        "lessThanOrEqual": "2.6.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiSwitch",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.8",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.7",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiNDR",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.1.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.4",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.5.0",
        "lessThanOrEqual": "1.5.3",
        "status": "affected"
      },
      {
        "version": "1.4.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.3.0",
        "lessThanOrEqual": "1.3.1",
        "status": "affected"
      },
      {
        "version": "1.2.0",
        "status": "affected"
      },
      {
        "version": "1.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiMail",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.3",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.9",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.12",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-038

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

30.0%

JSON

Related for CVE-2022-27488