CVE-2022-38378

2023-02-1619:15:12

CWE-269

[email protected]

web.nvd.nist.gov

cve-2022-38378

cwe-269

fortinet fortios

fortiproxy

vulnerability

privilege management

nvd

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.

Affected configurations

NVD

Node

fortinetfortiproxyRange1.1.0–2.0.9

fortinetfortiproxyRange7.0.0–7.0.8

fortinetfortiproxyRange7.2.0–7.2.2

fortinetfortiosRange6.0.0–7.0.8

fortinetfortiosRange7.2.0–7.2.1

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxyle2.0.9
fortinet:fortiproxyfortinet fortiproxylt7.0.8
fortinet:fortiproxyfortinet fortiproxylt7.2.2
fortinet:fortiosfortinet fortioslt7.0.8
fortinet:fortiosfortinet fortioslt7.2.1

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	le	2.0.9
fortinet:fortiproxy	fortinet fortiproxy	lt	7.0.8
fortinet:fortiproxy	fortinet fortiproxy	lt	7.2.2
fortinet:fortios	fortinet fortios	lt	7.0.8
fortinet:fortios	fortinet fortios	lt	7.2.1

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "7.2.0",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.4.0",
        "lessThanOrEqual": "6.4.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.2.0",
        "lessThanOrEqual": "6.2.12",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "6.0.0",
        "lessThanOrEqual": "6.0.16",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.7",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "2.0.0",
        "lessThanOrEqual": "2.0.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.2.0",
        "lessThanOrEqual": "1.2.13",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "1.1.0",
        "lessThanOrEqual": "1.1.6",
        "status": "affected"
      }
    ]
  }
]