Paper/Archive/CVE-2022-39954

CVE-2022-39954

Fortinet FortiNAC — An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through…

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 45.9.459 × 209.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents.

Affected

ProductAffectedFixed inSource

FortiNAC9.4.0 – 9.4.1–CNA

FortiNAC9.2.0 – 9.2.7–CNA

FortiNAC9.1.0 – 9.1.8–CNA

FortiNAC8.8.0 – 8.8.11–CNA

FortiNAC8.7.0 – 8.7.6–CNA

FortiNAC8.6.0 – 8.6.5–CNA

FortiNAC8.5.0 – 8.5.4–CNA

FortiNAC8.3.7–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

fortinet (CNA)6.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reffortiguard.com/psirt/FG-IR-22-304