PT-2023-2527 · Fortinet · Fortinac

CVE-2022-43951 · Publicado 2023-04-11 · Atualizado 2023-04-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiNAC versions 9.4.1 and below FortiNAC versions 9.2.6 and below FortiNAC versions 9.1.8 and below FortiNAC versions 8.8.11 and below FortiNAC versions 8.7.6 and below

Description The issue is related to an exposure of sensitive information to an unauthorized actor, which may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. This is due to a lack of protection for service data.

Recommendations For FortiNAC versions 9.4.1 and below, update to a version above 9.4.1 to resolve the issue. For FortiNAC versions 9.2.6 and below, update to a version above 9.2.6 to resolve the issue. For FortiNAC versions 9.1.8 and below, update to a version above 9.1.8 to resolve the issue. For FortiNAC versions 8.8.11 and below, update to a version above 8.8.11 to resolve the issue. For FortiNAC versions 8.7.6 and below, update to a version above 8.7.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information via crafted HTTP requests until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-02326

CVE-2022-43951

Produtos afetados

Fortinac

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-43951 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-22-409 · Aviso do Fabricante
• https://t.me/cibsecurity/61892 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-43951 · Aviso do Fabricante
• https://t.me/cvenotify/48513 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02326 · Nota de Segurança