PT-2022-17685 · Fortinet · Fortianalyzer+1

Published 2022-07-18 · Updated 2025-01-12 · CVE-2022-26118

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiManager versions 6.0.x through 7.0.3 FortiAnalyzer versions 6.0.x through 7.0.3

Description A privilege chaining issue may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system.

Recommendations For FortiManager versions 6.0.x through 7.0.3, update to a version that fixes the incorrect permissions of folders and executable files. For FortiAnalyzer versions 6.0.x through 7.0.3, update to a version that fixes the incorrect permissions of folders and executable files. As a temporary workaround, consider restricting access to sensitive folders and executable files until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-26118

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://osv.dev/vulnerability/CVE-2022-26118 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-21-056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26118 · Security Note
• https://t.me/aptreports/15289 · Telegram Post
• https://t.me/aptreports/15287 · Telegram Post
• https://t.me/cibsecurity/46486 · Telegram Post