PT-2023-13601 · Fortinet · Fortiproxy+1

CVE-2022-38378 · Publicado 2023-02-16 · Atualizado 2023-02-24

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions prior to 7.0.7 FortiProxy versions 7.2.0 through 7.2.1 and prior to 7.0.7

Description An improper privilege management issue allows an attacker with access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.

Recommendations For Fortinet FortiOS versions prior to 7.0.7, update to a version that includes the fix for this issue. For FortiProxy versions 7.2.0 through 7.2.1 and prior to 7.0.7, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the admin profile section (System subsection Administrator Users) to minimize the risk of exploitation.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2022-38378

Produtos afetados

Fortios

Fortiproxy

Referências · 4

• https://osv.dev/vulnerability/CVE-2022-38378 · Aviso do Fabricante
• https://fortiguard.com/psirt/FG-IR-22-346 · Aviso do Fabricante
• https://t.me/cibsecurity/58345 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-38378 · Nota de Segurança