Lucene search

FortinetCVE-2022-39946

HistoryJun 13, 2023 - 9:15 a.m.

CVE-2022-39946

2023-06-1309:15:14

CWE-284

fortinet

web.nvd.nist.gov

cve-2022-39946

access control

vulnerability

fortinac

cwe-284

nvd

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RC:C

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

44.2%

JSON

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

Affected configurations

Nvd

Node

fortinetfortinacRange8.5.0–8.5.4

fortinetfortinacRange8.6.0–8.6.5

fortinetfortinacRange8.7.0–8.7.6

fortinetfortinacRange8.8.0–8.8.11

fortinetfortinacRange9.1.0–9.1.10

fortinetfortinacRange9.2.0–9.2.8

fortinetfortinacMatch9.4.0

fortinetfortinacMatch9.4.1

fortinetfortinacMatch9.4.2

VendorProductVersionCPE
fortinetfortinac*cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
fortinetfortinac9.4.0cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*
fortinetfortinac9.4.1cpe:2.3:a:fortinet:fortinac:9.4.1:*:*:*:*:*:*:*
fortinetfortinac9.4.2cpe:2.3:a:fortinet:fortinac:9.4.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortinac	*	cpe:2.3:a:fortinet:fortinac::::::::
fortinet	fortinac	9.4.0	cpe:2.3:a:fortinet:fortinac:9.4.0:::::::*
fortinet	fortinac	9.4.1	cpe:2.3:a:fortinet:fortinac:9.4.1:::::::*
fortinet	fortinac	9.4.2	cpe:2.3:a:fortinet:fortinac:9.4.2:::::::*

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiNAC",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "9.4.0",
        "lessThanOrEqual": "9.4.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.2.0",
        "lessThanOrEqual": "9.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.1.0",
        "lessThanOrEqual": "9.1.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.8.0",
        "lessThanOrEqual": "8.8.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.7.0",
        "lessThanOrEqual": "8.7.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.6.0",
        "lessThanOrEqual": "8.6.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.5.0",
        "lessThanOrEqual": "8.5.4",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-332