CVE-2022-38378
En bref Sévérité MEDIUM 4.0 EPSS EPSS 0.24 % · centile 15 (2026-10-27) État PUBLISHED Publiée 2023-02-16 Mise à jour 2024-10-22 Attribuée par fortinet Statut NVD Modified Description An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 4.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C fortinet CVSS 3.1 MEDIUM 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.1.0 ≤ 2.0.9cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.2cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 < 7.0.8cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.1Produits affectés Produit Versions Fortinet · FortiOS affected 7.2.0 ; affected 7.0.0 ≤ 7.0.7 ; affected 6.4.0 ≤ 6.4.11 ; affected 6.2.0 ≤ 6.2.12 ; affected 6.0.0 ≤ 6.0.16 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.1 ; affected 7.0.0 ≤ 7.0.7 ; affected 2.0.0 ≤ 2.0.11 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6
Références
Sources
