Lucene search

[email protected]CVE-2022-22300

HistoryMar 01, 2022 - 7:15 p.m.

CVE-2022-22300

2022-03-0119:15:08

CWE-755

[email protected]

web.nvd.nist.gov

fortinet

fortianalyzer

fortimanager

cve-2022-22300

security vulnerability

insufficient permissions

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows attacker to bypass the device policy and force the password-change action for its user.

Affected configurations

NVD

Node

fortinetfortianalyzerRange5.6.0–5.6.11

fortinetfortianalyzerRange6.0.0–6.0.11

fortinetfortianalyzerRange6.2.0–6.2.9

fortinetfortianalyzerRange6.4.0–6.4.7

fortinetfortianalyzerRange7.0.0–7.0.3

fortinetfortimanagerRange5.6.0–5.6.11

fortinetfortimanagerRange6.0.0–6.0.11

fortinetfortimanagerRange6.2.0–6.2.9

fortinetfortimanagerRange6.4.0–6.4.7

fortinetfortimanagerRange7.0.0–7.0.3

CPENameOperatorVersion
fortinet:fortianalyzerfortinet fortianalyzerle5.6.11
fortinet:fortianalyzerfortinet fortianalyzerle6.0.11
fortinet:fortianalyzerfortinet fortianalyzerle6.2.9
fortinet:fortianalyzerfortinet fortianalyzerle6.4.7
fortinet:fortianalyzerfortinet fortianalyzerlt7.0.3
fortinet:fortimanagerfortinet fortimanagerle5.6.11
fortinet:fortimanagerfortinet fortimanagerle6.0.11
fortinet:fortimanagerfortinet fortimanagerle6.2.9
fortinet:fortimanagerfortinet fortimanagerle6.4.7
fortinet:fortimanagerfortinet fortimanagerlt7.0.3

CPE	Name	Operator	Version
fortinet:fortianalyzer	fortinet fortianalyzer	le	5.6.11
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.0.11
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.2.9
fortinet:fortianalyzer	fortinet fortianalyzer	le	6.4.7
fortinet:fortianalyzer	fortinet fortianalyzer	lt	7.0.3
fortinet:fortimanager	fortinet fortimanager	le	5.6.11
fortinet:fortimanager	fortinet fortimanager	le	6.0.11
fortinet:fortimanager	fortinet fortimanager	le	6.2.9
fortinet:fortimanager	fortinet fortimanager	le	6.4.7
fortinet:fortimanager	fortinet fortimanager	lt	7.0.3

CNA Affected

[
  {
    "product": "Fortinet FortiManager, FortiAnalyzer",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "FortiManager 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0; FortiAnalyzer 7.0.2, 7.0.1, 7.0.0, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.11, 5.6.10, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.1, 5.6.0"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-21-255

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2022-22300

cvelist1 fortinet1 cnvd1 prion1 nvd1