CVE-2022-35842

2022-11-0212:15:53

CWE-200

[email protected]

web.nvd.nist.gov

cve-2022-35842

cwe-200

fortios

ssl-vpn

vulnerability

unauthorized actor

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.4%

JSON

An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.

Affected configurations

NVD

Node

fortinetfortiosRange6.4.0–6.4.9

fortinetfortiosRange7.0.0–7.0.6

fortinetfortiosMatch7.2.0

CPENameOperatorVersion
fortinet:fortiosfortinet fortiosle6.4.9
fortinet:fortiosfortinet fortiosle7.0.6
fortinet:fortiosfortinet fortioseq7.2.0

CPE	Name	Operator	Version
fortinet:fortios	fortinet fortios	le	6.4.9
fortinet:fortios	fortinet fortios	le	7.0.6
fortinet:fortios	fortinet fortios	eq	7.2.0

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "Fortinet FortiOS",
    "versions": [
      {
        "version": "FortiOS 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0",
        "status": "affected"
      }
    ]
  }
]