Lucene search

[email protected]NVD:CVE-2022-35842

HistoryNov 02, 2022 - 12:15 p.m.

CVE-2022-35842

2022-11-0212:15:53

CWE-200

[email protected]

web.nvd.nist.gov

sensitive information

unauthorized actor

vulnerability

fortios ssl-vpn

remote attacker

ldap

saml

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

57.6%

JSON

An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.

Affected configurations

Nvd

Node

fortinetfortiosRange6.4.0–6.4.9

fortinetfortiosRange7.0.0–7.0.6

fortinetfortiosMatch7.2.0

VendorProductVersionCPE
fortinetfortios*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
fortinetfortios7.2.0cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fortinet	fortios	*	cpe:2.3:o:fortinet:fortios::::::::
fortinet	fortios	7.2.0	cpe:2.3:o:fortinet:fortios:7.2.0:::::::*

References

fortiguard.com/psirt/FG-IR-22-223

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

57.6%

JSON

Related for NVD:CVE-2022-35842

nessus1 cvelist1 cve1 prion1 fortinet1