PT-2022-21878 · Fortinet · Fortiadc

Published 2022-12-06 · Updated 2022-12-08 · CVE-2022-33875

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiADC versions 6.2.4 and below Fortinet FortiADC versions 7.0.0 through 7.0.2 Fortinet FortiADC version 7.1.0

Description An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Recommendations For Fortinet FortiADC versions 6.2.4 and below, update to a version above 6.2.4 to mitigate the risk. For Fortinet FortiADC versions 7.0.0 through 7.0.2, update to a version above 7.0.2 to mitigate the risk. For Fortinet FortiADC version 7.1.0, update to a version above 7.1.0 to mitigate the risk. As a temporary workaround, consider restricting access to the SQL command interface until a patch is available. Avoid using specifically crafted HTTP requests in the affected API endpoints until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-33875

Affected Products

Fortiadc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-33875 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-252 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33875 · Vendor Advisory
• https://t.me/cibsecurity/54083 · Telegram Post
• https://t.me/cvenotify/39304 · Telegram Post