PT-2023-14409 · Fortinet · Fortinac-F+1

Published 2023-05-03 · Updated 2023-05-11 · CVE-2022-43950

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiNAC-F version 7.2.0 FortiNAC versions 9.4.1 and below FortiNAC versions 9.2 and earlier FortiNAC versions 8.8 and earlier FortiNAC versions 8.7 and earlier

Description A URL redirection to untrusted site ('Open Redirect') issue may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL.

Recommendations For FortiNAC-F version 7.2.0, consider disabling URL redirection functionality until a patch is available. For FortiNAC versions 9.4.1 and below, restrict access to crafted URLs to minimize the risk of exploitation. For FortiNAC versions 9.2 and earlier, avoid using URLs that may be redirected to untrusted sites. For FortiNAC versions 8.8 and earlier, consider implementing additional security measures to prevent URL redirection attacks. For FortiNAC versions 8.7 and earlier, restrict user access to URLs that may be vulnerable to redirection.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-43950

Affected Products

Fortinac

Fortinac-F

References · 5

• https://fortiguard.com/psirt/FG-IR-22-407 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43950 · Security Note
• https://t.me/cibsecurity/63267 · Telegram Post
• https://t.me/cvenotify/49766 · Telegram Post