Lucene search

[email protected]CVE-2022-39946

HistoryJun 13, 2023 - 9:15 a.m.

CVE-2022-39946

2023-06-1309:15:14

CWE-284

[email protected]

web.nvd.nist.gov

cve-2022-39946

access control

vulnerability

fortinac

cwe-284

nvd

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RC:C

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.7%

JSON

An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.

Affected configurations

NVD

Node

fortinetfortinacRange8.5.0–8.5.4

fortinetfortinacRange8.6.0–8.6.5

fortinetfortinacRange8.7.0–8.7.6

fortinetfortinacRange8.8.0–8.8.11

fortinetfortinacRange9.1.0–9.1.10

fortinetfortinacRange9.2.0–9.2.8

fortinetfortinacMatch9.4.0

fortinetfortinacMatch9.4.1

fortinetfortinacMatch9.4.2

CPENameOperatorVersion
fortinet:fortinacfortinet fortinacle8.5.4
fortinet:fortinacfortinet fortinacle8.6.5
fortinet:fortinacfortinet fortinacle8.7.6
fortinet:fortinacfortinet fortinacle8.8.11
fortinet:fortinacfortinet fortinacle9.1.10
fortinet:fortinacfortinet fortinacle9.2.8
fortinet:fortinacfortinet fortinaceq9.4.0
fortinet:fortinacfortinet fortinaceq9.4.1
fortinet:fortinacfortinet fortinaceq9.4.2

CPE	Name	Operator	Version
fortinet:fortinac	fortinet fortinac	le	8.5.4
fortinet:fortinac	fortinet fortinac	le	8.6.5
fortinet:fortinac	fortinet fortinac	le	8.7.6
fortinet:fortinac	fortinet fortinac	le	8.8.11
fortinet:fortinac	fortinet fortinac	le	9.1.10
fortinet:fortinac	fortinet fortinac	le	9.2.8
fortinet:fortinac	fortinet fortinac	eq	9.4.0
fortinet:fortinac	fortinet fortinac	eq	9.4.1
fortinet:fortinac	fortinet fortinac	eq	9.4.2

CNA Affected

[
  {
    "vendor": "Fortinet",
    "product": "FortiNAC",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "9.4.0",
        "lessThanOrEqual": "9.4.1",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.2.0",
        "lessThanOrEqual": "9.2.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "9.1.0",
        "lessThanOrEqual": "9.1.10",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.8.0",
        "lessThanOrEqual": "8.8.11",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.7.0",
        "lessThanOrEqual": "8.7.6",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.6.0",
        "lessThanOrEqual": "8.6.5",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "8.5.0",
        "lessThanOrEqual": "8.5.4",
        "status": "affected"
      }
    ]
  }
]

References

fortiguard.com/psirt/FG-IR-22-332