PT-2022-6448 · Fortinet · Fortinac

Published 2022-09-14 · Updated 2023-03-14 · CVE-2022-40676

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiNAC versions 8.3.7, 8.5.0 through 8.5.4, 8.6.0 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.8, 9.2.0 through 9.2.5, 9.4.0

Description The issue is related to an improper neutralization of input during web page generation, which can be exploited for cross-site scripting attacks. This allows a remote attacker to execute unauthorized code or commands via specially crafted HTTP requests.

Recommendations For Fortinet FortiNAC versions 8.3.7, 8.5.0 through 8.5.4, 8.6.0 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.8, 9.2.0 through 9.2.5, 9.4.0, consider updating to a version that includes a fix for this issue as soon as it becomes available. As a temporary workaround, consider restricting access to the web interface of Fortinet FortiNAC to minimize the risk of exploitation. Avoid using specially crafted HTTP requests to the affected system until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01332

CVE-2022-40676

Affected Products

Fortinac

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-40676 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40676 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-22-281 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01332 · Security Note
• https://t.me/cvenotify/46122 · Telegram Post
• https://vuldb.com/?id.222542 · Note
• https://t.me/cibsecurity/59591 · Telegram Post