CVE-2022-43953

2023-06-1309:15:16

CWE-134

[email protected]

web.nvd.nist.gov

cve-2022-43953

external format string

fortinet fortios

fortiproxy

unauthorized code execution

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

Percentile

5.3%

JSON

A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.

Affected configurations

Nvd

Node

fortinetfortiproxyRange7.0.0–7.0.7

fortinetfortiproxyMatch7.2.0

fortinetfortiproxyMatch7.2.1

fortinetfortiosRange6.2.0–6.2.15

fortinetfortiosRange6.4.0–6.4.12

fortinetfortiosRange7.0.0–7.0.11

fortinetfortiosRange7.2.0–7.2.4

VendorProductVersionCPE
fortinetfortiproxy*cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinetfortiproxy7.2.0cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
fortinetfortiproxy7.2.1cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortiproxy	*	cpe:2.3:a:fortinet:fortiproxy::::::::
fortinet	fortiproxy	7.2.0	cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::*
fortinet	fortiproxy	7.2.1	cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::*
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::