Lucene search

[email protected]CVE-2022-42476

HistoryMar 07, 2023 - 5:15 p.m.

CVE-2022-42476

2023-03-0717:15:00

CWE-22

[email protected]

web.nvd.nist.gov

fortinet

fortios

fortiproxy

cve-2022-42476

vulnerability

cwe-23

privilege escalation

cli

nvd

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

9.9%

JSON

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

CPENameOperatorVersion
fortinet:fortiproxyfortinet fortiproxyle1.1.6
fortinet:fortiproxyfortinet fortiproxyle1.2.13
fortinet:fortiproxyfortinet fortiproxyeq7.2.0
fortinet:fortiosfortinet fortiosle6.2.12
fortinet:fortiosfortinet fortiosle7.0.8
fortinet:fortiproxyfortinet fortiproxyle7.0.7
fortinet:fortiproxyfortinet fortiproxyle2.0.11
fortinet:fortiosfortinet fortiosle6.4.11
fortinet:fortiproxyfortinet fortiproxyeq7.2.1
fortinet:fortiosfortinet fortiosle7.2.3

CPE	Name	Operator	Version
fortinet:fortiproxy	fortinet fortiproxy	le	1.1.6
fortinet:fortiproxy	fortinet fortiproxy	le	1.2.13
fortinet:fortiproxy	fortinet fortiproxy	eq	7.2.0
fortinet:fortios	fortinet fortios	le	6.2.12
fortinet:fortios	fortinet fortios	le	7.0.8
fortinet:fortiproxy	fortinet fortiproxy	le	7.0.7
fortinet:fortiproxy	fortinet fortiproxy	le	2.0.11
fortinet:fortios	fortinet fortios	le	6.4.11
fortinet:fortiproxy	fortinet fortiproxy	eq	7.2.1
fortinet:fortios	fortinet fortios	le	7.2.3

References

fortiguard.com/psirt/FG-IR-22-401

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:M/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

9.9%

JSON

Related for CVE-2022-42476

prion1 nessus1 fortinet1 cvelist1 ics1