PT-2023-9682 · Fortinet · Fortianalyzer+1

Publicado 2023-04-11 · Atualizado 2023-04-18 · CVE-2022-42477

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FortiManager and FortiAnalyzer versions prior to 7.2.1 FortiAnalyzer versions prior to 7.0.6 FortiAnalyzer version 6.4

Description The issue is related to improper input validation, which may allow an authenticated attacker to disclose file system information via custom SQL queries to a dataset. This can potentially reveal sensitive information about the file system.

Recommendations For FortiManager and FortiAnalyzer versions prior to 7.2.1, update to a version that includes the fix for this issue. For FortiAnalyzer versions prior to 7.0.6, update to a version that includes the fix for this issue. For FortiAnalyzer version 6.4, consider disabling custom dataset SQL queries until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2024-09672

CVE-2022-42477

Produtos afetados

Fortianalyzer

Fortimanager

Referências · 5

• https://t.me/cibsecurity/61894 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-42477 · Nota de Segurança
• https://fortiguard.com/psirt/FG-IR-22-432 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-09672 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-42477 · Aviso do Fabricante