Paper/Archive/CVE-2022-38375

CVE-2022-38375

Fortinet FortiNAC — An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenti…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 65.1.651 × 2013.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.

Affected

ProductAffectedFixed inSource

FortiNAC9.4.0 – 9.4.1–CNA

FortiNAC9.2.0 – 9.2.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:U/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reffortiguard.com/psirt/FG-IR-22-329