Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
saintSAINT CorporationSAINT:3D9272E5DF5B68BC6BFFAC8C65DC1FDF
HistoryFeb 24, 2023 - 12:00 a.m.

FortiNAC keyUpload.jsp command execution

2023-02-2400:00:00
SAINT Corporation
my.saintcorporation.com
64
fortinac
network access control
command execution
vulnerability
file upload
zip file
remote attackers
upgrade
fortinac 7.2.0
fortinac 9.1.8
fortinac 9.2.6
fortinac 9.4.1
security advisory

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.949 High

EPSS

Percentile

99.3%

JSON

Added: 02/24/2023

Background

FortiNAC is a network access control solution.

Problem

A vulnerability in the **keyUpload.jsp** resource allows remote attackers to write arbitrary files by uploading a specially crafted zip file, leading to command execution.

Resolution

Upgrade to FortiNAC 7.2.0, 9.1.8, 9.2.6, 9.4.1 or higher.

References

<https://www.fortiguard.com/psirt/FG-IR-22-300&gt;
<https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/&gt;

Platforms

FortiNAC

Related

githubexploit 4
cve 1
prion 1
fortinet 1
nessus 1
nvd 1
saint 1
packetstorm 1
attackerkb 1
metasploit 1
nuclei 1
cvelist 1
zdt 1
thn 4
rapid7blog 1
trellix 2
githubexploit
githubexploit
Exploit for External Control of File Name or Path in Fortinet Fortinac
2023-02-22 04:57:06
Exploit for External Control of File Name or Path in Fortinet Fortinac
2023-02-20 15:12:33
Exploit for External Control of File Name or Path in Fortinet Fortinac
2023-02-26 18:10:04
cve
cve
CVE-2022-39952
2023-02-16 19:15:13
prion
prion
Xxe
2023-02-16 19:15:00
fortinet
fortinet
FortiNAC - External Control of File Name or Path in keyUpload scriptlet
2023-02-16 00:00:00
nessus
nessus
FortiNAC - External Control of File Name or Path in keyUpload scriptlet (FG-IR-22-300)
2023-06-26 00:00:00
nvd
nvd
CVE-2022-39952
2023-02-16 19:15:13
saint
saint
FortiNAC keyUpload.jsp command execution
2023-02-24 00:00:00
packetstorm
packetstorm
Fortinet FortiNAC keyUpload.jsp Arbitrary File Write
2023-03-15 00:00:00
attackerkb
attackerkb
CVE-2022-39952
2023-02-16 00:00:00
metasploit
metasploit
Fortinet FortiNAC keyUpload.jsp arbitrary file write
2023-03-08 19:08:46
nuclei
nuclei
Fortinet FortiNAC - Arbitrary File Write
2023-02-21 15:47:52
cvelist
cvelist
CVE-2022-39952
2023-02-16 18:06:55
zdt
zdt
Fortinet FortiNAC keyUpload.jsp Arbitrary File Write Exploit
2023-03-15 00:00:00
thn
thn
Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy
2023-02-19 06:27:00
New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access
2023-03-09 05:23:00
New Fortinet's FortiNAC Vulnerability Exposes Networks to Code Execution Attacks
2023-06-27 05:35:00
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-03-17 19:33:24
trellix
trellix
The Bug Report – February 2023 Edition
2023-03-01 00:00:00
The Bug Report – February 2023 Edition
2023-03-01 00:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.949 High

EPSS

Percentile

99.3%

JSON
Related for SAINT:3D9272E5DF5B68BC6BFFAC8C65DC1FDF
githubexploit4cve1prion1fortinet1nessus1nvd1saint1packetstorm1attackerkb1metasploit1nuclei1cvelist1zdt1thn4rapid7blog1trellix2