PT-2023-7377 · Fortinet · Fortinac-F+1

Published 2023-05-03 · Updated 2023-05-09 · CVE-2023-22637

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiNAC-F version 7.2.0 FortiNAC versions 9.4.2 and below FortiNAC versions 9.2 and earlier FortiNAC versions 9.1 and earlier FortiNAC versions 8.8 and earlier FortiNAC versions 8.7 and earlier

Description The issue is related to an improper neutralization of input during web page generation, also known as Cross-site Scripting. This could allow an authenticated attacker to trigger remote code execution via crafted licenses in the License Management component.

Recommendations For FortiNAC-F version 7.2.0, update to a version that fixes the issue. For FortiNAC versions 9.4.2 and below, update to a version above 9.4.2. For FortiNAC versions 9.2 and earlier, update to a version above 9.2. For FortiNAC versions 9.1 and earlier, update to a version above 9.1. For FortiNAC versions 8.8 and earlier, update to a version above 8.8. For FortiNAC versions 8.7 and earlier, update to a version above 8.7. As a temporary workaround, consider restricting access to the License Management component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08409

CVE-2023-22637

Affected Products

Fortinac

Fortinac-F

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-22637 · Security Note
• https://fortiguard.com/psirt/FG-IR-23-013 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08409 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22637 · Vendor Advisory
• https://t.me/cvenotify/49772 · Telegram Post
• https://t.me/cibsecurity/63270 · Telegram Post
• https://t.me/cvenotify/50086 · Telegram Post