PT-2023-2527 · Fortinet · Fortinac

Published 2023-04-11 · Updated 2023-04-18 · CVE-2022-43951

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiNAC versions 9.4.1 and below FortiNAC versions 9.2.6 and below FortiNAC versions 9.1.8 and below FortiNAC versions 8.8.11 and below FortiNAC versions 8.7.6 and below

Description The issue is related to an exposure of sensitive information to an unauthorized actor, which may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests. This is due to a lack of protection for service data.

Recommendations For FortiNAC versions 9.4.1 and below, update to a version above 9.4.1 to resolve the issue. For FortiNAC versions 9.2.6 and below, update to a version above 9.2.6 to resolve the issue. For FortiNAC versions 9.1.8 and below, update to a version above 9.1.8 to resolve the issue. For FortiNAC versions 8.8.11 and below, update to a version above 8.8.11 to resolve the issue. For FortiNAC versions 8.7.6 and below, update to a version above 8.7.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information via crafted HTTP requests until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-02326

CVE-2022-43951

Affected Products

Fortinac

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-43951 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-409 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43951 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02326 · Security Note
• https://t.me/cibsecurity/61892 · Telegram Post
• https://t.me/cvenotify/48513 · Telegram Post