CVE-2022-38375 - An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests

Back Back to CVE browser

CRITICAL

An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests

Published Feb 16, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.08%

Description

An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.

Affected products

Vendor Fortinet Product FortiNAC Default
unaffected
Affected
- ≥ 9.2.0, ≤ 9.2.6
- ≥ 9.4.0, ≤ 9.4.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Fortinet	FortiNAC	unaffected	Affected ≥ 9.2.0, ≤ 9.2.6 ≥ 9.4.0, ≤ 9.4.1

Remediation

Vendor solution

Please upgrade to FortiNAC-F version 7.2.0 or above Please upgrade to FortiNAC version 9.4.2 or above Please upgrade to FortiNAC version 9.2.7 or above

Weaknesses (1)

CWE-285