Vulnerability-Lookup

CVE-2022-42476 (GCVE-0-2022-42476)

Vulnerability from cvelistv5 – Published: 2023-03-07 16:21 – Updated: 2026-10-22 13:48

Summary

A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-23 14:11 UTC

CWE

CWE-23 - Escalation of privilege

Assigner

fortinet CNA under the mitre root

CNA scorecard C 72/100 over 56 records in the last 180 days details

References

1 reference

URL	Tags
https://fortiguard.com/psirt/FG-IR-22-401

Impacted products

2 products

Vendor	Product	Version	CPE status
Fortinet	FortiOS	Affected: 7.2.0 , ≤ 7.2.3 (semver) Affected: 7.0.0 , ≤ 7.0.8 (semver) Affected: 6.4.0 , ≤ 6.4.11 (semver) Affected: 6.2.0 , ≤ 6.2.12 (semver) cpe:2.3:o:fortinet:fortios:7.2.3:::::::* cpe:2.3:o:fortinet:fortios:7.2.2:::::::* cpe:2.3:o:fortinet:fortios:7.2.1:::::::* cpe:2.3:o:fortinet:fortios:7.2.0:::::::* cpe:2.3:o:fortinet:fortios:7.0.8:::::::* cpe:2.3:o:fortinet:fortios:7.0.7:::::::* cpe:2.3:o:fortinet:fortios:7.0.6:::::::* cpe:2.3:o:fortinet:fortios:7.0.5:::::::* cpe:2.3:o:fortinet:fortios:7.0.4:::::::* cpe:2.3:o:fortinet:fortios:7.0.3:::::::* cpe:2.3:o:fortinet:fortios:7.0.2:::::::* cpe:2.3:o:fortinet:fortios:7.0.1:::::::* cpe:2.3:o:fortinet:fortios:7.0.0:::::::* cpe:2.3:o:fortinet:fortios:6.4.11:::::::* cpe:2.3:o:fortinet:fortios:6.4.10:::::::* cpe:2.3:o:fortinet:fortios:6.4.9:::::::* cpe:2.3:o:fortinet:fortios:6.4.8:::::::* cpe:2.3:o:fortinet:fortios:6.4.7:::::::* cpe:2.3:o:fortinet:fortios:6.4.6:::::::* cpe:2.3:o:fortinet:fortios:6.4.5:::::::* cpe:2.3:o:fortinet:fortios:6.4.4:::::::* cpe:2.3:o:fortinet:fortios:6.4.3:::::::* cpe:2.3:o:fortinet:fortios:6.4.2:::::::* cpe:2.3:o:fortinet:fortios:6.4.1:::::::* cpe:2.3:o:fortinet:fortios:6.4.0:::::::* cpe:2.3:o:fortinet:fortios:6.2.12:::::::* cpe:2.3:o:fortinet:fortios:6.2.11:::::::* cpe:2.3:o:fortinet:fortios:6.2.10:::::::* cpe:2.3:o:fortinet:fortios:6.2.9:::::::* cpe:2.3:o:fortinet:fortios:6.2.8:::::::* cpe:2.3:o:fortinet:fortios:6.2.7:::::::* cpe:2.3:o:fortinet:fortios:6.2.6:::::::* cpe:2.3:o:fortinet:fortios:6.2.5:::::::* cpe:2.3:o:fortinet:fortios:6.2.4:::::::* cpe:2.3:o:fortinet:fortios:6.2.3:::::::* cpe:2.3:o:fortinet:fortios:6.2.2:::::::* cpe:2.3:o:fortinet:fortios:6.2.1:::::::* cpe:2.3:o:fortinet:fortios:6.2.0:::::::*
Fortinet	FortiProxy	Affected: 7.2.0 , ≤ 7.2.1 (semver) Affected: 7.0.0 , ≤ 7.0.7 (semver) Affected: 2.0.0 , ≤ 2.0.11 (semver) Affected: 1.2.1 , ≤ 1.2.13 (semver) Affected: 01.02.00 Affected: 1.1.4 , ≤ 1.1.6 (semver) Affected: 01.01.00 , ≤ 01.01.03 (semver) cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.0:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.11:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.10:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.9:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.8:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.7:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.6:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.5:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.4:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.3:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.2:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.1:::::::* cpe:2.3:a:fortinet:fortiproxy:2.0.0:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.13:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.12:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.11:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.10:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.9:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.8:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.7:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.6:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.5:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.4:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.3:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.2:::::::* cpe:2.3:a:fortinet:fortiproxy:1.2.1:::::::* cpe:2.3:a:fortinet:fortiproxy:01.02.00:::::::* cpe:2.3:a:fortinet:fortiproxy:1.1.6:::::::* cpe:2.3:a:fortinet:fortiproxy:1.1.5:::::::* cpe:2.3:a:fortinet:fortiproxy:1.1.4:::::::* cpe:2.3:a:fortinet:fortiproxy:01.01.03:::::::* cpe:2.3:a:fortinet:fortiproxy:01.01.02:::::::* cpe:2.3:a:fortinet:fortiproxy:01.01.01:::::::* cpe:2.3:a:fortinet:fortiproxy:01.01.00:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:10:40.836Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://fortiguard.com/psirt/FG-IR-22-401",
            "tags": [
              "x_transferred"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-22-401"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-42476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T14:11:27.802267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-23T14:31:15.323Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.8",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.11",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.12",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:01.02.00:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.1.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.1.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:1.1.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:01.01.03:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:01.01.02:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:01.01.01:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:01.01.00:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.1",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.7",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.11",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.13",
              "status": "affected",
              "version": "1.2.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "01.02.00"
            },
            {
              "lessThanOrEqual": "1.1.6",
              "status": "affected",
              "version": "1.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "01.01.03",
              "status": "affected",
              "version": "01.01.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "Escalation of privilege",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T13:48:27.328Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.com/psirt/FG-IR-22-401",
          "url": "https://fortiguard.com/psirt/FG-IR-22-401"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiProxy version 7.2.2 or above\nUpgrade to FortiProxy version 7.0.8 or above\nUpgrade to FortiProxy version 2.0.12 or above\nUpgrade to FortiOS version 7.2.4 or above\nUpgrade to FortiOS version 7.0.9 or above\nUpgrade to FortiOS version 6.4.12 or above\nUpgrade to FortiOS version 6.2.13 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2022-42476",
    "datePublished": "2023-03-07T16:21:53.725Z",
    "dateReserved": "2022-10-07T14:05:36.301Z",
    "dateUpdated": "2026-10-22T13:48:27.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-42476",
      "date": "2026-10-22",
      "epss": "0.00217",
      "percentile": "0.11551"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
                  "versionEndIncluding": "1.1.6",
                  "versionStartIncluding": "1.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
                  "versionEndIncluding": "1.2.13",
                  "versionStartIncluding": "1.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6607C71D-D434-430A-8DFD-9125381D2D36",
                  "versionEndIncluding": "2.0.11",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3F3A99BB-534C-4984-948B-8FFF659A9B9B",
                  "versionEndIncluding": "7.0.7",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "F5F302F8-482A-4DA9-BDD9-63886B202B52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                  "matchCriteriaId": "91E7F209-D645-48EC-BB5F-E730E55E8EE9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "20B53FFE-073D-43E9-9D6F-9C86937C0228",
                  "versionEndIncluding": "6.2.12",
                  "versionStartIncluding": "6.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A87D865A-6411-4807-81D4-6A5C052C03C9",
                  "versionEndIncluding": "6.4.11",
                  "versionStartIncluding": "6.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0983FC2C-A9F2-4918-81E6-BDCF05E5BF65",
                  "versionEndIncluding": "7.0.8",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "813E179E-B948-4480-A5B1-B0ED562A41BC",
                  "versionEndIncluding": "7.2.3",
                  "versionStartIncluding": "7.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
        }
      ],
      "id": "CVE-2022-42476",
      "lastModified": "2024-11-21T07:25:02.870",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.5,
            "impactScore": 6.0,
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.5,
            "impactScore": 6.0,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-03-07T17:15:12.303",
      "references": [
        {
          "source": "psirt@fortinet.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://fortiguard.com/psirt/FG-IR-22-401"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://fortiguard.com/psirt/FG-IR-22-401"
        }
      ],
      "sourceIdentifier": "psirt@fortinet.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-23"
            }
          ],
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.12:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiOS",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.2.3",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.8",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.4.11",
                    "status": "affected",
                    "version": "6.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.12",
                    "status": "affected",
                    "version": "6.2.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.13:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.12:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:01.02.00:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.1.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.1.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:1.1.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:01.01.03:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:01.01.02:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:01.01.01:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:01.01.00:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiProxy",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.2.1",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.7",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "2.0.11",
                    "status": "affected",
                    "version": "2.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "1.2.13",
                    "status": "affected",
                    "version": "1.2.1",
                    "versionType": "semver"
                  },
                  {
                    "status": "affected",
                    "version": "01.02.00"
                  },
                  {
                    "lessThanOrEqual": "1.1.6",
                    "status": "affected",
                    "version": "1.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "01.01.03",
                    "status": "affected",
                    "version": "01.01.00",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
                    "versionEndIncluding": "1.1.6",
                    "versionStartIncluding": "1.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
                    "versionEndIncluding": "1.2.13",
                    "versionStartIncluding": "1.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6607C71D-D434-430A-8DFD-9125381D2D36",
                    "versionEndIncluding": "2.0.11",
                    "versionStartIncluding": "2.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3F3A99BB-534C-4984-948B-8FFF659A9B9B",
                    "versionEndIncluding": "7.0.7",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5F302F8-482A-4DA9-BDD9-63886B202B52",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "91E7F209-D645-48EC-BB5F-E730E55E8EE9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20B53FFE-073D-43E9-9D6F-9C86937C0228",
                    "versionEndIncluding": "6.2.12",
                    "versionStartIncluding": "6.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A87D865A-6411-4807-81D4-6A5C052C03C9",
                    "versionEndIncluding": "6.4.11",
                    "versionStartIncluding": "6.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0983FC2C-A9F2-4918-81E6-BDCF05E5BF65",
                    "versionEndIncluding": "7.0.8",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "813E179E-B948-4480-A5B1-B0ED562A41BC",
                    "versionEndIncluding": "7.2.3",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
          }
        ],
        "id": "CVE-2022-42476",
        "lastModified": "2026-10-22T14:17:29.667",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 6.0,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 6.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-42476",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-23T14:11:27.802267Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-03-07T17:15:12.303",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-22-401"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.com/psirt/FG-IR-22-401"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-23"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T13:10:40.836Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://fortiguard.com/psirt/FG-IR-22-401",
                "tags": [
                  "x_transferred"
                ],
                "url": "https://fortiguard.com/psirt/FG-IR-22-401"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-42476",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-23T14:11:27.802267Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-23T14:15:07.340Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.12:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiOS",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.2.3",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.8",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.4.11",
                  "status": "affected",
                  "version": "6.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.12",
                  "status": "affected",
                  "version": "6.2.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:01.02.00:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.1.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.1.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:1.1.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:01.01.03:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:01.01.02:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:01.01.01:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:01.01.00:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiProxy",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.2.1",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.7",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "2.0.11",
                  "status": "affected",
                  "version": "2.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "1.2.13",
                  "status": "affected",
                  "version": "1.2.1",
                  "versionType": "semver"
                },
                {
                  "status": "affected",
                  "version": "01.02.00"
                },
                {
                  "lessThanOrEqual": "1.1.6",
                  "status": "affected",
                  "version": "1.1.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "01.01.03",
                  "status": "affected",
                  "version": "01.01.00",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-23",
                  "description": "Escalation of privilege",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-22T13:48:27.328Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.com/psirt/FG-IR-22-401",
              "url": "https://fortiguard.com/psirt/FG-IR-22-401"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to FortiProxy version 7.2.2 or above\nUpgrade to FortiProxy version 7.0.8 or above\nUpgrade to FortiProxy version 2.0.12 or above\nUpgrade to FortiOS version 7.2.4 or above\nUpgrade to FortiOS version 7.0.9 or above\nUpgrade to FortiOS version 6.4.12 or above\nUpgrade to FortiOS version 6.2.13 or above"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2022-42476",
        "datePublished": "2023-03-07T16:21:53.725Z",
        "dateReserved": "2022-10-07T14:05:36.301Z",
        "dateUpdated": "2026-10-22T13:48:27.328Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2023-AVI-0199

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Fortinet. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité, un déni de service à distance, une élévation de privilèges, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiManager	FortiManager versions 6.0.x antérieures à 6.0.5
Fortinet	FortiWeb	FortiWeb versions 7.0.x antérieures à 7.0.3
Fortinet	FortiSwitch	FortiSwitch versions 7.0.x antérieures à 7.0.5
Fortinet	FortiRecorder	FortiRecorder versions antérieures à 7.0.0
Fortinet	FortiPortal	FortiPortal versions 6.0.x antérieures à 6.0.10
Fortinet	FortiWeb	FortiWeb versions 6.4.x antérieures à 6.4.2
Fortinet	FortiMail	FortiMail versions 6.0.x antérieures à 6.0.10
Fortinet	FortiSwitch	FortiSwitch versions 6.4.x antérieures à 6.4.11
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.0.x antérieures à 6.0.5
Fortinet	FortiNAC	FortiNAC versions 9.2.x antérieures à 9.2.7
Fortinet	FortiOS	FortiOS versions antérieures à 7.4.0
Fortinet	FortiOS	FortiOS versions 6.2.x antérieures à 6.2.13
Fortinet	FortiWeb	FortiWeb versions 6.3.x antérieures à 6.3.21
Fortinet	FortiNAC	FortiNAC versions 9.4.x antérieures à 9.4.2
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.2.x antérieures à 6.2.0
Fortinet	FortiMail	FortiMail versions 6.2.x antérieures à 6.2.5
Fortinet	N/A	FortiAuthenticator versions antérieures à 6.5.0
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.2
Fortinet	FortiRecorder	FortiRecorder versions 6.4.x antérieures à 6.4.4
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.13
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.4.x antérieures à 6.4.11
Fortinet	FortiProxy	FortiProxy versions 7.0.x antérieures à 7.0.9
Fortinet	FortiMail	FortiMail versions 6.4.x antérieures à 6.4.1
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.6
Fortinet	FortiWeb	FortiWeb versions antérieures à 7.2.0
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.12
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.10
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.3
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.4
Fortinet	FortiRecorder	FortiRecorder versions 6.0.x antérieures à 6.0.12
Fortinet	FortiNAC	FortiNAC versions antérieures à 7.2.0
Fortinet	FortiDeceptor	FortiDeceptor versions antérieures à 3.2.0
Fortinet	FortiManager	FortiManager versions antérieures à 6.2.0
Fortinet	FortiSOAR	FortiSOAR versions 7.3.x antérieures à 7.3.2
Fortinet	FortiProxy	FortiProxy versions 2.0.x antérieures à 2.0.12
Fortinet	FortiOS	FortiOS versions 6.4.x antérieures à 6.4.12
Fortinet	FortiNAC	FortiNAC versions 9.1.x antérieures à 9.1.9
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.10

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet FG-IR-20-078 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-447 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-488 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-369 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-477 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-254 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-388 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-401 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-23-050 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-281 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-23-001 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-21-218 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-18-232 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-309 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-364 du 07 mars 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiManager versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitch versions 7.0.x ant\u00e9rieures \u00e0 7.0.5",
      "product": {
        "name": "FortiSwitch",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions ant\u00e9rieures \u00e0 7.0.0",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPortal versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "FortiPortal",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitch versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
      "product": {
        "name": "FortiSwitch",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.7",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.3.x ant\u00e9rieures \u00e0 6.3.21",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.2",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.2.x ant\u00e9rieures \u00e0 6.2.0",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.2.x ant\u00e9rieures \u00e0 6.2.5",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions ant\u00e9rieures \u00e0 6.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions 6.4.x ant\u00e9rieures \u00e0 6.4.4",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.9",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.4.x ant\u00e9rieures \u00e0 6.4.1",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions ant\u00e9rieures \u00e0 7.2.0",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions 6.0.x ant\u00e9rieures \u00e0 6.0.12",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions ant\u00e9rieures \u00e0 7.2.0",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDeceptor versions ant\u00e9rieures \u00e0 3.2.0",
      "product": {
        "name": "FortiDeceptor",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions ant\u00e9rieures \u00e0 6.2.0",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSOAR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
      "product": {
        "name": "FortiSOAR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.12",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.1.x ant\u00e9rieures \u00e0 9.1.9",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-29056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29056"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-27490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27490"
    },
    {
      "name": "CVE-2022-41333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41333"
    },
    {
      "name": "CVE-2023-25611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25611"
    },
    {
      "name": "CVE-2022-39953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39953"
    },
    {
      "name": "CVE-2023-23776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23776"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2022-22297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22297"
    },
    {
      "name": "CVE-2022-39951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39951"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2022-40676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40676"
    },
    {
      "name": "CVE-2023-25605",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25605"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0199",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-03-08T00:00:00.000000"
    },
    {
      "description": "Correction mineure dans la partie r\u00e9sum\u00e9",
      "revision_date": "2023-03-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eFortinet\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une injection de\ncode indirecte \u00e0 distance (XSS), un contournement de la politique de\ns\u00e9curit\u00e9, un d\u00e9ni de service \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-078 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-20-078"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-447 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-447"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-488 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-488"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-369 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-369"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-477 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-477"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-254 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-254"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-388 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-388"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-401 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-401"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-050 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-050"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-281 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-281"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-001 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-001"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-218 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-21-218"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-18-232 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-18-232"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-309 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-309"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-364 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-364"
    }
  ]
}

CERTFR-2024-AVI-0203

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	Cerberus PRO EN Engineering Tool versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8
Siemens	N/A	RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions
Siemens	N/A	Sinteso FS20 EN Engineering Tool versions antérieures à MP8
Siemens	N/A	SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.2
Siemens	N/A	Solid Edge versions antérieures à V223.0.11
Siemens	N/A	Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	SINEMA Remote Connect Client versions antérieures à V3.1 SP1
Siemens	N/A	SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Sinteso Mobile versions antérieures à V3.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité Siemens SSA-792319 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-918992 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-353002 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-653855 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-225840 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-145196 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-382651 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-832273 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-366067 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-770721 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-576771 du 12 mars 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cerberus PRO EN Engineering Tool versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Fire Panel FC20 versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM APE1808 avec Fortinet NGFW versions ant\u00e9rieures \u00e0 V7.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Engineering Tool versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF160B (6GT2003-0FA00) versions ant\u00e9rieures \u00e0 V2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Solid Edge versions ant\u00e9rieures \u00e0 V223.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Control versions sup\u00e9rieures ou \u00e9gales \u00e0 V2.8 versions ant\u00e9rieures \u00e0 V3.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN Fire Panel FC72x versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Client versions ant\u00e9rieures \u00e0 V3.1 SP1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso Mobile versions ant\u00e9rieures \u00e0 V3.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
    },
    {
      "name": "CVE-2017-18509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
    },
    {
      "name": "CVE-2021-0599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
    },
    {
      "name": "CVE-2021-0443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
    },
    {
      "name": "CVE-2022-20462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
    },
    {
      "name": "CVE-2021-0598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
    },
    {
      "name": "CVE-2021-0438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
    },
    {
      "name": "CVE-2021-0651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
    },
    {
      "name": "CVE-2021-0585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
    },
    {
      "name": "CVE-2021-0331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
    },
    {
      "name": "CVE-2021-0509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
    },
    {
      "name": "CVE-2021-0601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
    },
    {
      "name": "CVE-2021-0478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
    },
    {
      "name": "CVE-2021-0397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
    },
    {
      "name": "CVE-2021-0600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
    },
    {
      "name": "CVE-2021-0928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
    },
    {
      "name": "CVE-2021-0484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
    },
    {
      "name": "CVE-2023-36641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36641"
    },
    {
      "name": "CVE-2021-0642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
    },
    {
      "name": "CVE-2021-0341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2021-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
    },
    {
      "name": "CVE-2020-24587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
    },
    {
      "name": "CVE-2017-14491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
    },
    {
      "name": "CVE-2022-20421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
    },
    {
      "name": "CVE-2021-0593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
    },
    {
      "name": "CVE-2022-20498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
    },
    {
      "name": "CVE-2021-0473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2021-0870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
    },
    {
      "name": "CVE-2020-0417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
    },
    {
      "name": "CVE-2020-29660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
    },
    {
      "name": "CVE-2021-0604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
    },
    {
      "name": "CVE-2021-0522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
    },
    {
      "name": "CVE-2021-39629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
    },
    {
      "name": "CVE-2020-29661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
    },
    {
      "name": "CVE-2021-38204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
    },
    {
      "name": "CVE-2022-20229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
    },
    {
      "name": "CVE-2023-33306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33306"
    },
    {
      "name": "CVE-2022-39948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
    },
    {
      "name": "CVE-2022-20423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
    },
    {
      "name": "CVE-2021-0396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
    },
    {
      "name": "CVE-2021-0650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
    },
    {
      "name": "CVE-2021-0329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
    },
    {
      "name": "CVE-2023-41675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41675"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-29183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29183"
    },
    {
      "name": "CVE-2021-0471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2021-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
    },
    {
      "name": "CVE-2021-0327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
    },
    {
      "name": "CVE-2021-0653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
    },
    {
      "name": "CVE-2021-0690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
    },
    {
      "name": "CVE-2021-39634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
    },
    {
      "name": "CVE-2021-0596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
    },
    {
      "name": "CVE-2023-47537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
    },
    {
      "name": "CVE-2023-28002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28002"
    },
    {
      "name": "CVE-2023-22641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
    },
    {
      "name": "CVE-2021-0919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
    },
    {
      "name": "CVE-2021-0968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
    },
    {
      "name": "CVE-2022-20500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
    },
    {
      "name": "CVE-2021-29647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
    },
    {
      "name": "CVE-2021-0521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
    },
    {
      "name": "CVE-2020-11301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
    },
    {
      "name": "CVE-2021-0953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
    },
    {
      "name": "CVE-2021-0926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
    },
    {
      "name": "CVE-2021-0961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2020-23064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
    },
    {
      "name": "CVE-2021-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
    },
    {
      "name": "CVE-2021-0339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
    },
    {
      "name": "CVE-2021-39627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
    },
    {
      "name": "CVE-2021-0437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2021-0433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
    },
    {
      "name": "CVE-2024-22041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22041"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2022-20473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
    },
    {
      "name": "CVE-2022-43947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
    },
    {
      "name": "CVE-2023-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41841"
    },
    {
      "name": "CVE-2021-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
    },
    {
      "name": "CVE-2022-20483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
    },
    {
      "name": "CVE-2020-25705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
    },
    {
      "name": "CVE-2024-22045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22045"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2023-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
    },
    {
      "name": "CVE-2021-0399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
    },
    {
      "name": "CVE-2023-33301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33301"
    },
    {
      "name": "CVE-2021-0476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
    },
    {
      "name": "CVE-2021-0507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
    },
    {
      "name": "CVE-2021-0390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
    },
    {
      "name": "CVE-2021-0444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
    },
    {
      "name": "CVE-2021-0520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
    },
    {
      "name": "CVE-2021-0586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
    },
    {
      "name": "CVE-2021-39633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
    },
    {
      "name": "CVE-2021-0587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
    },
    {
      "name": "CVE-2021-0952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
    },
    {
      "name": "CVE-2022-20476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
    },
    {
      "name": "CVE-2020-10768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
    },
    {
      "name": "CVE-2022-20472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
    },
    {
      "name": "CVE-2021-0326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
    },
    {
      "name": "CVE-2021-0929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
    },
    {
      "name": "CVE-2022-20227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
    },
    {
      "name": "CVE-2021-0336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
    },
    {
      "name": "CVE-2023-44250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44250"
    },
    {
      "name": "CVE-2021-0506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
    },
    {
      "name": "CVE-2021-0515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
    },
    {
      "name": "CVE-2022-20355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
    },
    {
      "name": "CVE-2021-0330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
    },
    {
      "name": "CVE-2021-0688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
    },
    {
      "name": "CVE-2021-0393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
    },
    {
      "name": "CVE-2024-21762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
    },
    {
      "name": "CVE-2021-0512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-20130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
    },
    {
      "name": "CVE-2021-0519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
    },
    {
      "name": "CVE-2021-0516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
    },
    {
      "name": "CVE-2021-39621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
    },
    {
      "name": "CVE-2021-33909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
    },
    {
      "name": "CVE-2022-42469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
    },
    {
      "name": "CVE-2021-1972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
    },
    {
      "name": "CVE-2021-1976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2021-0640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
    },
    {
      "name": "CVE-2020-14305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
    },
    {
      "name": "CVE-2023-36555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36555"
    },
    {
      "name": "CVE-2022-20422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
    },
    {
      "name": "CVE-2022-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
    },
    {
      "name": "CVE-2023-22640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22640"
    },
    {
      "name": "CVE-2021-0400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
    },
    {
      "name": "CVE-2022-20469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
    },
    {
      "name": "CVE-2020-26558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
    },
    {
      "name": "CVE-2021-0706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
    },
    {
      "name": "CVE-2021-0682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
    },
    {
      "name": "CVE-2021-0480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
    },
    {
      "name": "CVE-2021-0429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2021-0683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
    },
    {
      "name": "CVE-2022-20411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-33307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33307"
    },
    {
      "name": "CVE-2021-0328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
    },
    {
      "name": "CVE-2021-0684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
    },
    {
      "name": "CVE-2022-20466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
    },
    {
      "name": "CVE-2023-40718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40718"
    },
    {
      "name": "CVE-2021-0920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
    },
    {
      "name": "CVE-2021-0704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
    },
    {
      "name": "CVE-2022-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
    },
    {
      "name": "CVE-2021-0436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
    },
    {
      "name": "CVE-2021-0584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2021-0594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
    },
    {
      "name": "CVE-2021-0591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
    },
    {
      "name": "CVE-2021-0514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
    },
    {
      "name": "CVE-2021-0511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
    },
    {
      "name": "CVE-2021-0931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
    },
    {
      "name": "CVE-2024-21483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21483"
    },
    {
      "name": "CVE-2020-15436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
    },
    {
      "name": "CVE-2023-45793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45793"
    },
    {
      "name": "CVE-2021-0689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
    },
    {
      "name": "CVE-2023-28001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28001"
    },
    {
      "name": "CVE-2021-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
    },
    {
      "name": "CVE-2021-0337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
    },
    {
      "name": "CVE-2022-32257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32257"
    },
    {
      "name": "CVE-2023-36639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36639"
    },
    {
      "name": "CVE-2021-39623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
    },
    {
      "name": "CVE-2022-41330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
    },
    {
      "name": "CVE-2021-0508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
    },
    {
      "name": "CVE-2021-0325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
    },
    {
      "name": "CVE-2021-0708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
    },
    {
      "name": "CVE-2022-41334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41334"
    },
    {
      "name": "CVE-2024-23113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
    },
    {
      "name": "CVE-2020-0338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
    },
    {
      "name": "CVE-2020-26555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
    },
    {
      "name": "CVE-2021-0302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
    },
    {
      "name": "CVE-2021-0589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
    },
    {
      "name": "CVE-2021-0305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
    },
    {
      "name": "CVE-2023-33308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33308"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2021-0431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
    },
    {
      "name": "CVE-2021-0392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
    },
    {
      "name": "CVE-2021-0474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
    },
    {
      "name": "CVE-2021-0930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
    },
    {
      "name": "CVE-2021-39626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
    },
    {
      "name": "CVE-2021-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    },
    {
      "name": "CVE-2023-37935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37935"
    },
    {
      "name": "CVE-2021-0695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
    },
    {
      "name": "CVE-2024-22040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22040"
    },
    {
      "name": "CVE-2021-0965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
    },
    {
      "name": "CVE-2021-0513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
    },
    {
      "name": "CVE-2021-0434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
    },
    {
      "name": "CVE-2021-0687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
    },
    {
      "name": "CVE-2021-0481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
    },
    {
      "name": "CVE-2021-0964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
    },
    {
      "name": "CVE-2021-0641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
    },
    {
      "name": "CVE-2021-0435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
    },
    {
      "name": "CVE-2021-0334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
    },
    {
      "name": "CVE-2021-0933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
    },
    {
      "name": "CVE-2021-0394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    },
    {
      "name": "CVE-2021-0588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
    },
    {
      "name": "CVE-2023-38545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
    },
    {
      "name": "CVE-2024-22039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22039"
    },
    {
      "name": "CVE-2021-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
    },
    {
      "name": "CVE-2021-0510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
    },
    {
      "name": "CVE-2021-0692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
    },
    {
      "name": "CVE-2024-22044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22044"
    },
    {
      "name": "CVE-2020-14381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0203",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-792319 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-792319.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-918992 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-918992.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-353002 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-353002.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-653855 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-225840 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-225840.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-145196 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-145196.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-382651 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-382651.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-832273 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-366067 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-366067.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-770721 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-576771 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
    }
  ]
}

CERTFR-2023-AVI-0199

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Fortinet	FortiManager	FortiManager versions 6.0.x antérieures à 6.0.5
Fortinet	FortiWeb	FortiWeb versions 7.0.x antérieures à 7.0.3
Fortinet	FortiSwitch	FortiSwitch versions 7.0.x antérieures à 7.0.5
Fortinet	FortiRecorder	FortiRecorder versions antérieures à 7.0.0
Fortinet	FortiPortal	FortiPortal versions 6.0.x antérieures à 6.0.10
Fortinet	FortiWeb	FortiWeb versions 6.4.x antérieures à 6.4.2
Fortinet	FortiMail	FortiMail versions 6.0.x antérieures à 6.0.10
Fortinet	FortiSwitch	FortiSwitch versions 6.4.x antérieures à 6.4.11
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.0.x antérieures à 6.0.5
Fortinet	FortiNAC	FortiNAC versions 9.2.x antérieures à 9.2.7
Fortinet	FortiOS	FortiOS versions antérieures à 7.4.0
Fortinet	FortiOS	FortiOS versions 6.2.x antérieures à 6.2.13
Fortinet	FortiWeb	FortiWeb versions 6.3.x antérieures à 6.3.21
Fortinet	FortiNAC	FortiNAC versions 9.4.x antérieures à 9.4.2
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.2.x antérieures à 6.2.0
Fortinet	FortiMail	FortiMail versions 6.2.x antérieures à 6.2.5
Fortinet	N/A	FortiAuthenticator versions antérieures à 6.5.0
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.2
Fortinet	FortiRecorder	FortiRecorder versions 6.4.x antérieures à 6.4.4
Fortinet	FortiOS	FortiOS-6K7K versions 6.2.x antérieures à 6.2.13
Fortinet	FortiAnalyzer	FortiAnalyzer versions 6.4.x antérieures à 6.4.11
Fortinet	FortiProxy	FortiProxy versions 7.0.x antérieures à 7.0.9
Fortinet	FortiMail	FortiMail versions 6.4.x antérieures à 6.4.1
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.6
Fortinet	FortiWeb	FortiWeb versions antérieures à 7.2.0
Fortinet	FortiOS	FortiOS-6K7K versions 6.4.x antérieures à 6.4.12
Fortinet	FortiOS	FortiOS-6K7K versions 7.0.x antérieures à 7.0.10
Fortinet	FortiProxy	FortiProxy versions 7.2.x antérieures à 7.2.3
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.4
Fortinet	FortiRecorder	FortiRecorder versions 6.0.x antérieures à 6.0.12
Fortinet	FortiNAC	FortiNAC versions antérieures à 7.2.0
Fortinet	FortiDeceptor	FortiDeceptor versions antérieures à 3.2.0
Fortinet	FortiManager	FortiManager versions antérieures à 6.2.0
Fortinet	FortiSOAR	FortiSOAR versions 7.3.x antérieures à 7.3.2
Fortinet	FortiProxy	FortiProxy versions 2.0.x antérieures à 2.0.12
Fortinet	FortiOS	FortiOS versions 6.4.x antérieures à 6.4.12
Fortinet	FortiNAC	FortiNAC versions 9.1.x antérieures à 9.1.9
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.10

References

Title

Publication Time

Tags

Bulletin de sécurité Fortinet FG-IR-20-078 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-447 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-488 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-369 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-477 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-254 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-388 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-401 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-23-050 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-281 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-23-001 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-21-218 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-18-232 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-309 du 07 mars 2023	None	vendor-advisory
Bulletin de sécurité Fortinet FG-IR-22-364 du 07 mars 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FortiManager versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 7.0.x ant\u00e9rieures \u00e0 7.0.3",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitch versions 7.0.x ant\u00e9rieures \u00e0 7.0.5",
      "product": {
        "name": "FortiSwitch",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions ant\u00e9rieures \u00e0 7.0.0",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiPortal versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "FortiPortal",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.0.x ant\u00e9rieures \u00e0 6.0.10",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSwitch versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
      "product": {
        "name": "FortiSwitch",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.0.x ant\u00e9rieures \u00e0 6.0.5",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.2.x ant\u00e9rieures \u00e0 9.2.7",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions 6.3.x ant\u00e9rieures \u00e0 6.3.21",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.4.x ant\u00e9rieures \u00e0 9.4.2",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.2.x ant\u00e9rieures \u00e0 6.2.0",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.2.x ant\u00e9rieures \u00e0 6.2.5",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAuthenticator versions ant\u00e9rieures \u00e0 6.5.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.2.x ant\u00e9rieures \u00e0 7.2.2",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions 6.4.x ant\u00e9rieures \u00e0 6.4.4",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.2.x ant\u00e9rieures \u00e0 6.2.13",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 6.4.x ant\u00e9rieures \u00e0 6.4.11",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.0.x ant\u00e9rieures \u00e0 7.0.9",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiMail versions 6.4.x ant\u00e9rieures \u00e0 6.4.1",
      "product": {
        "name": "FortiMail",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiAnalyzer versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
      "product": {
        "name": "FortiAnalyzer",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiWeb versions ant\u00e9rieures \u00e0 7.2.0",
      "product": {
        "name": "FortiWeb",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS-6K7K versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 7.2.x ant\u00e9rieures \u00e0 7.2.3",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.2.x ant\u00e9rieures \u00e0 7.2.4",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiRecorder versions 6.0.x ant\u00e9rieures \u00e0 6.0.12",
      "product": {
        "name": "FortiRecorder",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions ant\u00e9rieures \u00e0 7.2.0",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiDeceptor versions ant\u00e9rieures \u00e0 3.2.0",
      "product": {
        "name": "FortiDeceptor",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiManager versions ant\u00e9rieures \u00e0 6.2.0",
      "product": {
        "name": "FortiManager",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiSOAR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
      "product": {
        "name": "FortiSOAR",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiProxy versions 2.0.x ant\u00e9rieures \u00e0 2.0.12",
      "product": {
        "name": "FortiProxy",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 6.4.x ant\u00e9rieures \u00e0 6.4.12",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiNAC versions 9.1.x ant\u00e9rieures \u00e0 9.1.9",
      "product": {
        "name": "FortiNAC",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    },
    {
      "description": "FortiOS versions 7.0.x ant\u00e9rieures \u00e0 7.0.10",
      "product": {
        "name": "FortiOS",
        "vendor": {
          "name": "Fortinet",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-29056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29056"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-27490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27490"
    },
    {
      "name": "CVE-2022-41333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41333"
    },
    {
      "name": "CVE-2023-25611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25611"
    },
    {
      "name": "CVE-2022-39953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39953"
    },
    {
      "name": "CVE-2023-23776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-23776"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2022-22297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22297"
    },
    {
      "name": "CVE-2022-39951",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39951"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2022-40676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40676"
    },
    {
      "name": "CVE-2023-25605",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25605"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0199",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-03-08T00:00:00.000000"
    },
    {
      "description": "Correction mineure dans la partie r\u00e9sum\u00e9",
      "revision_date": "2023-03-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eFortinet\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une injection de\ncode indirecte \u00e0 distance (XSS), un contournement de la politique de\ns\u00e9curit\u00e9, un d\u00e9ni de service \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges,\nune atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Fortinet",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-20-078 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-20-078"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-447 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-447"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-488 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-488"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-369 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-369"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-477 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-477"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-254 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-254"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-388 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-388"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-401 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-401"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-050 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-050"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-281 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-281"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-23-001 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-23-001"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-21-218 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-21-218"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-18-232 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-18-232"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-309 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-309"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Fortinet FG-IR-22-364 du 07 mars 2023",
      "url": "https://www.fortiguard.com/psirt/FG-IR-22-364"
    }
  ]
}

CERTFR-2024-AVI-0203

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Siemens	N/A	Cerberus PRO EN Engineering Tool versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN Fire Panel FC20 versions antérieures à MP8
Siemens	N/A	RUGGEDCOM APE1808 avec Fortinet NGFW versions antérieures à V7.4.1
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.0.x antérieures à V4.0.5016
Siemens	N/A	SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions
Siemens	N/A	Sinteso FS20 EN Engineering Tool versions antérieures à MP8
Siemens	N/A	SIMATIC RF160B (6GT2003-0FA00) versions antérieures à V2.2
Siemens	N/A	SINEMA Remote Connect Server versions antérieures à V3.2
Siemens	N/A	Solid Edge versions antérieures à V223.0.11
Siemens	N/A	Siveillance Control versions supérieures ou égales à V2.8 versions antérieures à V3.1.1
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Cerberus PRO EN Fire Panel FC72x versions antérieures à IP8
Siemens	N/A	SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	SINEMA Remote Connect Client versions antérieures à V3.1 SP1
Siemens	N/A	SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions supérieures ou égales à V3.2.3 versions antérieures à V3.3.0
Siemens	N/A	Cerberus PRO EN X300 Cloud Distribution versions V4.2.x antérieures à V4.2.5015
Siemens	N/A	Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Cerberus PRO EN X200 Cloud Distribution versions V4.3.x antérieures à V4.3.5618
Siemens	N/A	Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x antérieures à V4.3.5617
Siemens	N/A	Sinteso Mobile versions antérieures à V3.0.0

References

Title

Publication Time

Tags

Bulletin de sécurité Siemens SSA-792319 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-918992 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-353002 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-653855 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-225840 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-145196 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-382651 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-832273 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-366067 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-770721 du 12 mars 2024	None	vendor-advisory
Bulletin de sécurité Siemens SSA-576771 du 12 mars 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cerberus PRO EN Engineering Tool versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Fire Panel FC20 versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "RUGGEDCOM APE1808 avec Fortinet NGFW versions ant\u00e9rieures \u00e0 V7.4.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.0.x ant\u00e9rieures \u00e0 V4.0.5016",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 3KC ATC6 Expansion Module Ethernet toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN Engineering Tool versions ant\u00e9rieures \u00e0 MP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SIMATIC RF160B (6GT2003-0FA00) versions ant\u00e9rieures \u00e0 V2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Server versions ant\u00e9rieures \u00e0 V3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Solid Edge versions ant\u00e9rieures \u00e0 V223.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Siveillance Control versions sup\u00e9rieures ou \u00e9gales \u00e0 V2.8 versions ant\u00e9rieures \u00e0 V3.1.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN Fire Panel FC72x versions ant\u00e9rieures \u00e0 IP8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SINEMA Remote Connect Client versions ant\u00e9rieures \u00e0 V3.1 SP1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) versions sup\u00e9rieures ou \u00e9gales \u00e0 V3.2.3 versions ant\u00e9rieures \u00e0 V3.3.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X300 Cloud Distribution versions V4.2.x ant\u00e9rieures \u00e0 V4.2.5015",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Cerberus PRO EN X200 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5618",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso FS20 EN X300 Cloud Distribution versions V4.3.x ant\u00e9rieures \u00e0 V4.3.5617",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    },
    {
      "description": "Sinteso Mobile versions ant\u00e9rieures \u00e0 V3.0.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0646"
    },
    {
      "name": "CVE-2017-18509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18509"
    },
    {
      "name": "CVE-2021-0599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0599"
    },
    {
      "name": "CVE-2021-0443",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0443"
    },
    {
      "name": "CVE-2022-20462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20462"
    },
    {
      "name": "CVE-2021-0598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0598"
    },
    {
      "name": "CVE-2021-0438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0438"
    },
    {
      "name": "CVE-2021-0651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0651"
    },
    {
      "name": "CVE-2021-0585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0585"
    },
    {
      "name": "CVE-2021-0331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0331"
    },
    {
      "name": "CVE-2021-0509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0509"
    },
    {
      "name": "CVE-2021-0601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0601"
    },
    {
      "name": "CVE-2021-0478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0478"
    },
    {
      "name": "CVE-2021-0397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0397"
    },
    {
      "name": "CVE-2021-0600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0600"
    },
    {
      "name": "CVE-2021-0928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0928"
    },
    {
      "name": "CVE-2021-0484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0484"
    },
    {
      "name": "CVE-2023-36641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36641"
    },
    {
      "name": "CVE-2021-0642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0642"
    },
    {
      "name": "CVE-2021-0341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0341"
    },
    {
      "name": "CVE-2023-38546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38546"
    },
    {
      "name": "CVE-2022-41329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41329"
    },
    {
      "name": "CVE-2021-0597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0597"
    },
    {
      "name": "CVE-2020-24587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-24587"
    },
    {
      "name": "CVE-2017-14491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-14491"
    },
    {
      "name": "CVE-2022-20421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20421"
    },
    {
      "name": "CVE-2021-0593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0593"
    },
    {
      "name": "CVE-2022-20498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20498"
    },
    {
      "name": "CVE-2021-0473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0473"
    },
    {
      "name": "CVE-2022-41328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41328"
    },
    {
      "name": "CVE-2022-42474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42474"
    },
    {
      "name": "CVE-2021-0870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0870"
    },
    {
      "name": "CVE-2020-0417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0417"
    },
    {
      "name": "CVE-2020-29660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29660"
    },
    {
      "name": "CVE-2021-0604",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0604"
    },
    {
      "name": "CVE-2021-0522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0522"
    },
    {
      "name": "CVE-2021-39629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39629"
    },
    {
      "name": "CVE-2020-29661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-29661"
    },
    {
      "name": "CVE-2021-38204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38204"
    },
    {
      "name": "CVE-2022-20229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20229"
    },
    {
      "name": "CVE-2023-33306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33306"
    },
    {
      "name": "CVE-2022-39948",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39948"
    },
    {
      "name": "CVE-2022-20423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20423"
    },
    {
      "name": "CVE-2021-0396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0396"
    },
    {
      "name": "CVE-2021-0650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0650"
    },
    {
      "name": "CVE-2021-0329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0329"
    },
    {
      "name": "CVE-2023-41675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41675"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2023-27997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27997"
    },
    {
      "name": "CVE-2023-29183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29183"
    },
    {
      "name": "CVE-2021-0471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0471"
    },
    {
      "name": "CVE-2023-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29181"
    },
    {
      "name": "CVE-2021-0963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0963"
    },
    {
      "name": "CVE-2021-0327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0327"
    },
    {
      "name": "CVE-2021-0653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0653"
    },
    {
      "name": "CVE-2021-0690",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0690"
    },
    {
      "name": "CVE-2021-39634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39634"
    },
    {
      "name": "CVE-2021-0596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0596"
    },
    {
      "name": "CVE-2023-47537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-47537"
    },
    {
      "name": "CVE-2023-28002",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28002"
    },
    {
      "name": "CVE-2023-22641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22641"
    },
    {
      "name": "CVE-2021-0919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0919"
    },
    {
      "name": "CVE-2021-0968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0968"
    },
    {
      "name": "CVE-2022-20500",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20500"
    },
    {
      "name": "CVE-2021-29647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29647"
    },
    {
      "name": "CVE-2021-0521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0521"
    },
    {
      "name": "CVE-2020-11301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11301"
    },
    {
      "name": "CVE-2021-0953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0953"
    },
    {
      "name": "CVE-2021-0926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0926"
    },
    {
      "name": "CVE-2021-0961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0961"
    },
    {
      "name": "CVE-2023-26207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26207"
    },
    {
      "name": "CVE-2020-23064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-23064"
    },
    {
      "name": "CVE-2021-0652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0652"
    },
    {
      "name": "CVE-2021-0339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0339"
    },
    {
      "name": "CVE-2021-39627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39627"
    },
    {
      "name": "CVE-2021-0437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0437"
    },
    {
      "name": "CVE-2023-29179",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29179"
    },
    {
      "name": "CVE-2021-0433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0433"
    },
    {
      "name": "CVE-2024-22041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22041"
    },
    {
      "name": "CVE-2023-33305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33305"
    },
    {
      "name": "CVE-2022-20473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20473"
    },
    {
      "name": "CVE-2022-43947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43947"
    },
    {
      "name": "CVE-2023-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-41841"
    },
    {
      "name": "CVE-2021-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0333"
    },
    {
      "name": "CVE-2022-20483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20483"
    },
    {
      "name": "CVE-2020-25705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25705"
    },
    {
      "name": "CVE-2024-22045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22045"
    },
    {
      "name": "CVE-2022-42476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42476"
    },
    {
      "name": "CVE-2023-49125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-49125"
    },
    {
      "name": "CVE-2021-0399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0399"
    },
    {
      "name": "CVE-2023-33301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33301"
    },
    {
      "name": "CVE-2021-0476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0476"
    },
    {
      "name": "CVE-2021-0507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0507"
    },
    {
      "name": "CVE-2021-0390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0390"
    },
    {
      "name": "CVE-2021-0444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0444"
    },
    {
      "name": "CVE-2021-0520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0520"
    },
    {
      "name": "CVE-2021-0586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0586"
    },
    {
      "name": "CVE-2021-39633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39633"
    },
    {
      "name": "CVE-2021-0587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0587"
    },
    {
      "name": "CVE-2021-0952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0952"
    },
    {
      "name": "CVE-2022-20476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20476"
    },
    {
      "name": "CVE-2020-10768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10768"
    },
    {
      "name": "CVE-2022-20472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20472"
    },
    {
      "name": "CVE-2021-0326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0326"
    },
    {
      "name": "CVE-2021-0929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0929"
    },
    {
      "name": "CVE-2022-20227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20227"
    },
    {
      "name": "CVE-2021-0336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0336"
    },
    {
      "name": "CVE-2023-44250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44250"
    },
    {
      "name": "CVE-2021-0506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0506"
    },
    {
      "name": "CVE-2021-0515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0515"
    },
    {
      "name": "CVE-2022-20355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20355"
    },
    {
      "name": "CVE-2021-0330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0330"
    },
    {
      "name": "CVE-2021-0688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0688"
    },
    {
      "name": "CVE-2021-0393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0393"
    },
    {
      "name": "CVE-2024-21762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21762"
    },
    {
      "name": "CVE-2021-0512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0512"
    },
    {
      "name": "CVE-2023-29178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29178"
    },
    {
      "name": "CVE-2022-20130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20130"
    },
    {
      "name": "CVE-2021-0519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0519"
    },
    {
      "name": "CVE-2021-0516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0516"
    },
    {
      "name": "CVE-2021-39621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39621"
    },
    {
      "name": "CVE-2021-33909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
    },
    {
      "name": "CVE-2022-42469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-42469"
    },
    {
      "name": "CVE-2021-1972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1972"
    },
    {
      "name": "CVE-2021-1976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-1976"
    },
    {
      "name": "CVE-2022-41327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41327"
    },
    {
      "name": "CVE-2021-0640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0640"
    },
    {
      "name": "CVE-2020-14305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14305"
    },
    {
      "name": "CVE-2023-36555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36555"
    },
    {
      "name": "CVE-2022-20422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20422"
    },
    {
      "name": "CVE-2022-20468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20468"
    },
    {
      "name": "CVE-2023-22640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22640"
    },
    {
      "name": "CVE-2021-0400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0400"
    },
    {
      "name": "CVE-2022-20469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20469"
    },
    {
      "name": "CVE-2020-26558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26558"
    },
    {
      "name": "CVE-2021-0706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0706"
    },
    {
      "name": "CVE-2021-0682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0682"
    },
    {
      "name": "CVE-2021-0480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0480"
    },
    {
      "name": "CVE-2021-0429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0429"
    },
    {
      "name": "CVE-2023-22639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22639"
    },
    {
      "name": "CVE-2021-0683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0683"
    },
    {
      "name": "CVE-2022-20411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20411"
    },
    {
      "name": "CVE-2022-43953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-43953"
    },
    {
      "name": "CVE-2023-33307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33307"
    },
    {
      "name": "CVE-2021-0328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0328"
    },
    {
      "name": "CVE-2021-0684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0684"
    },
    {
      "name": "CVE-2022-20466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20466"
    },
    {
      "name": "CVE-2023-40718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40718"
    },
    {
      "name": "CVE-2021-0920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0920"
    },
    {
      "name": "CVE-2021-0704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0704"
    },
    {
      "name": "CVE-2022-20127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-20127"
    },
    {
      "name": "CVE-2021-0436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0436"
    },
    {
      "name": "CVE-2021-0584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0584"
    },
    {
      "name": "CVE-2022-45861",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45861"
    },
    {
      "name": "CVE-2021-0594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0594"
    },
    {
      "name": "CVE-2021-0591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0591"
    },
    {
      "name": "CVE-2021-0514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0514"
    },
    {
      "name": "CVE-2021-0511",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0511"
    },
    {
      "name": "CVE-2021-0931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0931"
    },
    {
      "name": "CVE-2024-21483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21483"
    },
    {
      "name": "CVE-2020-15436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15436"
    },
    {
      "name": "CVE-2023-45793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45793"
    },
    {
      "name": "CVE-2021-0689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0689"
    },
    {
      "name": "CVE-2023-28001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28001"
    },
    {
      "name": "CVE-2021-0970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0970"
    },
    {
      "name": "CVE-2021-0337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0337"
    },
    {
      "name": "CVE-2022-32257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32257"
    },
    {
      "name": "CVE-2023-36639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36639"
    },
    {
      "name": "CVE-2021-39623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39623"
    },
    {
      "name": "CVE-2022-41330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41330"
    },
    {
      "name": "CVE-2021-0508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0508"
    },
    {
      "name": "CVE-2021-0325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0325"
    },
    {
      "name": "CVE-2021-0708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0708"
    },
    {
      "name": "CVE-2022-41334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41334"
    },
    {
      "name": "CVE-2024-23113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23113"
    },
    {
      "name": "CVE-2020-0338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-0338"
    },
    {
      "name": "CVE-2020-26555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
    },
    {
      "name": "CVE-2021-0302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0302"
    },
    {
      "name": "CVE-2021-0589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0589"
    },
    {
      "name": "CVE-2021-0305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0305"
    },
    {
      "name": "CVE-2023-33308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33308"
    },
    {
      "name": "CVE-2023-29175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29175"
    },
    {
      "name": "CVE-2021-0431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0431"
    },
    {
      "name": "CVE-2021-0392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0392"
    },
    {
      "name": "CVE-2021-0474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0474"
    },
    {
      "name": "CVE-2021-0930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0930"
    },
    {
      "name": "CVE-2021-39626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-39626"
    },
    {
      "name": "CVE-2021-0967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0967"
    },
    {
      "name": "CVE-2023-25610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25610"
    },
    {
      "name": "CVE-2023-37935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37935"
    },
    {
      "name": "CVE-2021-0695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0695"
    },
    {
      "name": "CVE-2024-22040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22040"
    },
    {
      "name": "CVE-2021-0965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0965"
    },
    {
      "name": "CVE-2021-0513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0513"
    },
    {
      "name": "CVE-2021-0434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0434"
    },
    {
      "name": "CVE-2021-0687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0687"
    },
    {
      "name": "CVE-2021-0481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0481"
    },
    {
      "name": "CVE-2021-0964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0964"
    },
    {
      "name": "CVE-2021-0641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0641"
    },
    {
      "name": "CVE-2021-0435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0435"
    },
    {
      "name": "CVE-2021-0334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0334"
    },
    {
      "name": "CVE-2021-0933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0933"
    },
    {
      "name": "CVE-2021-0394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0394"
    },
    {
      "name": "CVE-2023-29180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29180"
    },
    {
      "name": "CVE-2021-0588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0588"
    },
    {
      "name": "CVE-2023-38545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38545"
    },
    {
      "name": "CVE-2024-22039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22039"
    },
    {
      "name": "CVE-2021-0391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0391"
    },
    {
      "name": "CVE-2021-0510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0510"
    },
    {
      "name": "CVE-2021-0692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-0692"
    },
    {
      "name": "CVE-2024-22044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22044"
    },
    {
      "name": "CVE-2020-14381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-14381"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0203",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-03-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits Siemens\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-792319 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-792319.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-918992 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-918992.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-353002 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-353002.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-653855 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-653855.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-225840 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-225840.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-145196 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-145196.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-382651 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-382651.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-832273 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-832273.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-366067 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-366067.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-770721 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770721.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens SSA-576771 du 12 mars 2024",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
    }
  ]
}

BDU:2023-01331 (CVE-2022-42476)

Vulnerability from fstec – Published: 2023-03-20 – Updated: 2023-03-20 – View on bdu.fstec.ru Fixed

Title

Уязвимость технологии виртуализации Virtual Domains (VDOM) операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю повысить свои привилегии

Summary

Уязвимость технологии виртуализации Virtual Domains (VDOM) операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy связана с ошибками в обработке относительного пути к каталогу. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии путем отправки специально сформированных запросов GET, POST и HEAD

Severity

6.5 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:M/C:C/I:C/A:C

8.2 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-22 - Неверное ограничение имени пути к каталогу с ограниченным доступом («Обход пути»)
CWE-23 - Обход относительного пути

Aliases

CVE-2022-42476, FG-IR-22-401

References

2 references

URL
https://www.fortiguard.com/psirt/FG-IR-22-401
https://vuldb.com/ru/?id.222499

Impacted products

2 products from 1 vendor

Vendors

Fortinet Inc.

Products

FortiProxy, FortiOS

Versions

от 1.2.0 до 1.2.13 включительно (FortiProxy), от 1.1.0 до 1.1.6 включительно (FortiProxy), 7.2.0 (FortiProxy), 7.2.1 (FortiProxy), от 7.0.0 до 7.0.7 включительно (FortiProxy), от 2.0.0 до 2.0.11 включительно (FortiProxy), от 6.2.0 до 6.2.12 включительно (FortiOS), от 6.4.0 до 6.4.11 включительно (FortiOS), от 7.0.0 до 7.0.8 включительно (FortiOS), от 7.2.0 до 7.2.3 включительно (FortiOS)

Product types

Security device, Security software, Operating system

Platforms

Fortinet Inc. FortiOS от 6.2.0 до 6.2.12 включительно, Fortinet Inc. FortiOS от 6.4.0 до 6.4.11 включительно, Fortinet Inc. FortiOS от 7.0.0 до 7.0.8 включительно, Fortinet Inc. FortiOS от 7.2.0 до 7.2.3 включительно

Mitigations

Использование рекомендаций: https://www.fortiguard.com/psirt/FG-IR-22-401

Credits

Влияние на FortiProxy веток 7.0.x, 2.0.x, 1.2.x, 1.1.x незначительно, так как они не поддерживают технологию VDOM

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:M/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fortinet Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 1.2.0 \u0434\u043e 1.2.13 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 1.1.0 \u0434\u043e 1.1.6 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), 7.2.0 (FortiProxy), 7.2.1 (FortiProxy), \u043e\u0442 7.0.0 \u0434\u043e 7.0.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 2.0.0 \u0434\u043e 2.0.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiProxy), \u043e\u0442 6.2.0 \u0434\u043e 6.2.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 6.4.0 \u0434\u043e 6.4.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.0.0 \u0434\u043e 7.0.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS), \u043e\u0442 7.2.0 \u0434\u043e 7.2.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (FortiOS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://www.fortiguard.com/psirt/FG-IR-22-401",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "07.10.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "20.03.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "20.03.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-01331",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-42476, FG-IR-22-401",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FortiProxy, FortiOS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Fortinet Inc. FortiOS \u043e\u0442 6.2.0 \u0434\u043e 6.2.12 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 6.4.0 \u0434\u043e 6.4.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 7.0.0 \u0434\u043e 7.0.8 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Fortinet Inc. FortiOS \u043e\u0442 7.2.0 \u0434\u043e 7.2.3 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Virtual Domains (VDOM) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c (\u00ab\u041e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438\u00bb) (CWE-22), \u041e\u0431\u0445\u043e\u0434 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 (CWE-23)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Virtual Domains (VDOM) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 GET, POST \u0438 HEAD",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "\u0412\u043b\u0438\u044f\u043d\u0438\u0435 \u043d\u0430 FortiProxy \u0432\u0435\u0442\u043e\u043a 7.0.x, 2.0.x, 1.2.x, 1.1.x \u043d\u0435\u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0442\u0430\u043a \u043a\u0430\u043a \u043e\u043d\u0438 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e VDOM",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.fortiguard.com/psirt/FG-IR-22-401\nhttps://vuldb.com/ru/?id.222499",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-22, CWE-23",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

FKIE_CVE-2022-42476

Vulnerability from fkie_nvd - Published: 2023-03-07 17:15 - Updated: 2026-06-17 05:05

Severity

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Summary

A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.

References

	URL	Tags
	psirt@fortinet.com	https://fortiguard.com/psirt/FG-IR-22-401	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://fortiguard.com/psirt/FG-IR-22-401	Vendor Advisory

Impacted products

Vendor	Product	Version
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	7.2.0
fortinet	fortiproxy	7.2.1
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.8",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.11",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.12",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.2.1",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.7",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.11",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.13",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.1.6",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
              "versionEndIncluding": "1.1.6",
              "versionStartIncluding": "1.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
              "versionEndIncluding": "1.2.13",
              "versionStartIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6607C71D-D434-430A-8DFD-9125381D2D36",
              "versionEndIncluding": "2.0.11",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F3A99BB-534C-4984-948B-8FFF659A9B9B",
              "versionEndIncluding": "7.0.7",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5F302F8-482A-4DA9-BDD9-63886B202B52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "91E7F209-D645-48EC-BB5F-E730E55E8EE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "20B53FFE-073D-43E9-9D6F-9C86937C0228",
              "versionEndIncluding": "6.2.12",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A87D865A-6411-4807-81D4-6A5C052C03C9",
              "versionEndIncluding": "6.4.11",
              "versionStartIncluding": "6.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0983FC2C-A9F2-4918-81E6-BDCF05E5BF65",
              "versionEndIncluding": "7.0.8",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "813E179E-B948-4480-A5B1-B0ED562A41BC",
              "versionEndIncluding": "7.2.3",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
    }
  ],
  "id": "CVE-2022-42476",
  "lastModified": "2026-06-17T05:05:00.890",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-42476",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-23T14:11:27.802267Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-03-07T17:15:12.303",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-22-401"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.com/psirt/FG-IR-22-401"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-W4P8-QCM4-827W

Vulnerability from github – Published: 2023-03-07 18:30 – Updated: 2023-03-14 21:30

Details

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-42476"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-07T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.",
  "id": "GHSA-w4p8-qcm4-827w",
  "modified": "2023-03-14T21:30:22Z",
  "published": "2023-03-07T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42476"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.com/psirt/FG-IR-22-401"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-42476

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-42476

Aliases

CVE-2022-42476

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-42476",
    "description": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.",
    "id": "GSD-2022-42476"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-42476"
      ],
      "details": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests.",
      "id": "GSD-2022-42476",
      "modified": "2023-12-13T01:19:10.686426Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@fortinet.com",
        "ID": "CVE-2022-42476",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "FortiOS",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.2.0",
                          "version_value": "7.2.3"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.0",
                          "version_value": "7.0.8"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.4.0",
                          "version_value": "6.4.11"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "6.2.0",
                          "version_value": "6.2.12"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "FortiProxy",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.2.0",
                          "version_value": "7.2.1"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "7.0.0",
                          "version_value": "7.0.7"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "2.0.0",
                          "version_value": "2.0.11"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "1.2.0",
                          "version_value": "1.2.13"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_name": "1.1.0",
                          "version_value": "1.1.6"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Fortinet"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-23",
                "lang": "eng",
                "value": "Escalation of privilege"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://fortiguard.com/psirt/FG-IR-22-401",
            "refsource": "MISC",
            "url": "https://fortiguard.com/psirt/FG-IR-22-401"
          }
        ]
      },
      "solution": [
        {
          "lang": "en",
          "value": "Please upgrade to FortiProxy version 7.2.2 or above\r\nPlease upgrade to FortiProxy version 7.0.8 or above\r\nPlease upgrade to FortiOS version 7.2.4 or above\r\nPlease upgrade to FortiOS version 7.0.9 or above\r\nPlease upgrade to FortiOS version 6.4.12 or above\r\nPlease upgrade to FortiOS version 6.2.13 or above\n\u00a0"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.1.6",
                "versionStartIncluding": "1.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.2.13",
                "versionStartIncluding": "1.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.2.12",
                "versionStartIncluding": "6.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.0.8",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.0.7",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.0.11",
                "versionStartIncluding": "2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.4.11",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "7.2.3",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@fortinet.com",
          "ID": "CVE-2022-42476"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://fortiguard.com/psirt/FG-IR-22-401",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://fortiguard.com/psirt/FG-IR-22-401"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.5,
          "impactScore": 6.0
        }
      },
      "lastModifiedDate": "2023-03-14T19:31Z",
      "publishedDate": "2023-03-07T17:15Z"
    }
  }
}

ICSA-24-074-11

Vulnerability from csaf_cisa - Published: 2024-03-12 00:00 - Updated: 2026-01-14 22:00

Summary

Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices

Scope

43 vulnerabilities in this advisory, including CVE-2022-42476.

CVE-2022-42476

8.2 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

SSA-366067

Vulnerability from csaf_siemens - Published: 2024-03-12 00:00 - Updated: 2026-01-13 00:00

Summary

SSA-366067: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices

Scope

43 vulnerabilities in this advisory, including CVE-2022-42476.

CVE-2022-42476

8.2 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-42476 (GCVE-0-2022-42476)

Solution

Solution

Solution

Solution

BDU:2023-01331 (CVE-2022-42476)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour